A security vulnerability in the way the server handles domain names leads to a local heap buffer overflow. I found two offsets where our shellcode can be placed. Since ret value is hardcoded, we should use two copies of shellcode. But last part of the second copy can be corrupted during procedure processing.
Solution is to check current offset of the shellcode and jump from second copy to the first one.
Also we avoids large letters in the shellcode and some other characters. Next was ripped from wildcoyote's gopher sploit. The information has been provided by Dmitry Galyant . Security Ltd. All rights reserved. Terms of Use Site Privacy Statement .