This is the original ngssoftware's (David Litchfield) exploit presented at blackhat 2003 with modified offsets.