[Full-disclosure] "Fire and forget" exploits?

[Brendan Dolan-Gavitt]

Hi,
  I'm looking for examples of (remote) security vulnerabilities whose
exploitation involves no guesswork--eg, no bruteforcing the return
address, or altering your exploit based on the server's response, etc.
  It seems like this kind of exploit is dying out, particularly as
different flavors of Linux proliferate, each with their own slightly
different libc and userland; in the Windows world, however, we still
find "universal" exploits that work on NT4/2k/XP over a variety of
service packs.
  Anyways, if anyone has come across things like this, I'd greatly
appreciate hearing about it. I'm working on some new methods to
deliver exploits at once while minimizing recon.

Thanks,
  Brendan Dolan-Gavitt