Kazaa exploit

[my_wan]

I copied the .dat (partial mp3 dowloads) files from a friends kazaa shared folder to finish them on my computer (much faster connection). Poking around inside them I found text scaps from all over her os, mainly html from tmp inet files. I promptly posted some links back to her and embarassed her real good I then decided to start a few of my own kazaa downloads to see what showed up. In one .dat --> .mp3 file I found almost complete configuation settings for my browser (MyIE2) that are stored in .ini files, includeing formdata.ini!

[Gravity]

Are .dat files large or are they small, because say they were small people with cable could download videos and then put the small .dat file somewhere so 56k users could download easier.

[Cybr1d]

cool. thanx for the info, i'll check out my crap too lol

[ZomBieMann77]

Okay just a few things here. 1 the .dat file size depends on the file you are downloading. Kazaa uses the.dat fil extension as kind of a temporary designation. 2 what are you using to "poke around inside them? im am just curiopus so that i can take a look and verify this for my self. Nothing personal but its sounds kinda funny. Im not sure how a partial mp3 can contain .html files from another users computer. I am interested in finding out more about this.

[Kimeramon_2001]

I think this can be right because once I downloaded 2 songs and I didnt like one of them so I deleted that one and started another download for a different song. In the middle of the download I played the new song and some of the old song was still there. So like half on the new .mp3 had the old song and half had the new song. But finally when the download of the new song was complete there was no old song in it. I wonder what's up with that!?

[Orangeguy]

Hmm never thought of doing that. Great now I have something new to toy around with on my computer thanks for the info on that

[er0k]

ZombieMan - notepad will read most .dat files.

[ZomBieMann77]

i tried it in notepad before i posted and didnt find any usefull tidbits inside any .dats. maybe im doing it wrong.

[my_wan]

Yes I'm using a simple text editor (not notepad). Various program will even cull out everything but the ascii text for you. Text scaps seems to be more prevalent with unfinished mp3's than anything else. I have previously noticed when viewing an unfinished movie an unrelated movie downloaded earlier sometimes plays a few frames at the end. The size of the .dat files is partially dependant on how quick you pause the download after starting it. Kazaa seems to have a minimum file chunk of 100kb (at least in my samples) even if you haven't actually downloaded that much yet. That probably explains why it is happening since any deleted file/s contained in that space will once again be designated as being part of a particular file. A little more forensics could reveal a lot more. A few attempts with other file types revealed no text, but out of six mp3's they all had at some recognizable text from other files.
Gravity, the .dat files and the movie files are the exact same file. Kazaa simply gives them a .dat extension until the download is finished. that wouldn't be any help to the dialup users. I downloaded for my friend then physically carried the files back to her computer when finished. USB memory is pretty cool.

[er0k]

wack, ive just always used notepad to read .dat

edit >> or you could just boot up in linux, mount your windows partition, and read it in any text editor.