gzipPoC.php

<?php

/*
    Copyright (C) 2013  Cyberis Ltd. Author geoff.jones@cyberis.co.uk

    This file is part of ResponseCoder, a server-side script is designed to 
    allow you to easily manipulate HTTP response headers, specifically to 
    identify weaknesses in perimeter filtering appliances such as web proxies and 
    next generation firewalls.

    ResponseCoder is free software: you can redistribute it and/or modify
    it under the terms of the GNU General Public License as published by
    the Free Software Foundation, either version 3 of the License, or
    (at your option) any later version.

    ResponseCoder is distributed in the hope that it will be useful,
    but WITHOUT ANY WARRANTY; without even the implied warranty of
    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
    GNU General Public License for more details.

    You should have received a copy of the GNU General Public License
    along with this program.  If not, see <http://www.gnu.org/licenses/>.
*/

if (!isset($_REQUEST['rounds'])) die("[Error] 'rounds' parameter not set\n");

$count = filter_var($_REQUEST['rounds'], FILTER_VALIDATE_INT);
$file = "./helloworld.exe";
$data = gzencode(file_get_contents($file));
$encoding = "gzip";
$encodingheading = "gzip";

for ($i = 1; $i < $count; $i++) {
	$encodingheading = $encodingheading . ", $encoding";
	$data = gzencode($data);
}

header("Content-Encoding: $encodingheading");
header("Content-Disposition: attachment; filename='helloworld.exe'");

echo $data;

?>