A security vulnerability in the way the server handles domain names leads to a local heap buffer overflow. I found two offsets where our shellcode can be placed. Since ret value is hardcoded, we should use two copies of shellcode. But last part of the second copy can be corrupted during procedure processing.
Solution is to check current offset of the shellcode and jump from second copy to the first one.
Also we avoids large letters in the shellcode and some other characters. Next was ripped from wildcoyote's gopher sploit. This bulletin is sent to members of the SecuriTeam mailing list. In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.