Microsoft Internet Explorer 4.0 for Windows 95/Windows NT 4 Setupctl ActiveX Control Buffer Overflow source: https://www.securityfocus.com/bid/667/info There is a buffer overflow in the setupctl ActiveX control that used to ship with some versions of Microsoft's Internet Explorer. This ActiveX control is used to link to an update site at Microsoft and is marked 'Safe for Scripting' . Arbitrary commands may be executed if the ActiveX control is run in a malicious manner. SETUPCTL Apparently a control that was once used for the IE update web site which is no longer in use, although it should still exist on a lot of systems. With this exploit, similar to the PDF exploit, ESP points to our code so we simply RET to the same JMP ESP in Shell32. Also, this exploit differs in that we set a property first (DistUnit) with the long string, then call the method (InstallNow). Again, I have simply demonstrated how to execute CALC.EXE, though any code can be executed.