rapid7/metasploit-framework — pull request #2530 by jlee-r7 (2013-10-16 21:01:54+00:00)
Title: Add support to ms13-080 for IE7 on XP

The pointer offset was off by one for IE7. For some reason changing the whole buffer to `%u2020%u2030` caused it to longer trigger the crash, but the surgical change of offset 6 made it work.

The change in the redirect URL was because apparently ie7 is less forgiving and will attempt to use a url like `http://search/?o=...` if your url looks like `//search?o=...`, which is a bit insane, but it's IE, so there you go.