Written by Sean de Regge (seanderegge hotmail.com) Exploit for the parameter injection bug in Realplayers RecordClip() activeX function and firefox plugin http://www.zerodayinitiative.com/advisories/ZDI-10-211/ C:\Program Files\Real\RealPlayer\RecordingManager.exe has 2 interesting switches: /t will spoof the download of any file so you can make it look like it's downloading a normal mp3 file /f will make it download to any location on the disk instead of the realplayer downloads folder Restrictions: The extension on server side must be a valid media file (ie: .mp3) Realplayer does some checks on the file to see if it is a valid media file too, so we need to create a chimera file, which will parse as a valid mp3 file and a valid batch file. Best is to take a valid mp3 file and modify it in a hex editor to have your batch commands in the first couple of bytes.