Prevx 3.0.5.210 config file Vulnerability

=========================================
Prevx 3.0.5.210 config file Vulnerability
=========================================

Author         : [STRELiTZIA]
Software       : [Prevx 3.0.5.210 and old]
Tested on      : [Windows All]
	
============================
=       Description        = 
============================

Prevx uses "csidb.csi" to store user's preferences, I expected to see it after analysis, elaborate and better protected,
because it contains very important information, like user's password, Enabling or disabling specific option, controling self protection levels and others.

Unfortunately this was not the case.

Location: \%Documents and Settings%\%All Users%\%Application Data%\PrevxCSI\csidb.csi

Prevx.exe, at first time loads the configuration file in memory, and any actual and effective changes are in memory,
the file on the disk used to store changes to read at the next startup.

Prevx uses a very basic approach:
- Stores and checks a simple '01' or '00' value at constant offsets for her options.
Below X86 platform offsets, for X64 platform a small shift offsets positions.

SELF PROTECTION:
Offset: 000017BC
Minimum = 00
Medium = 02
Maximum = 01

USER'S PASSWORD:
Only MD5 hash for user's password without any additional encryption.
Eg. 8B1A9953C4611296A827ABF8C47804D7 = MD5(Hello)

Offset : 000031A0 (Stored MD5 hash user's password)

Offset : 0000319C (Enable/Disable password checks option)
Val = 00 : (Disable password check)
Val = 01 : (Enable password check)

OTHER OPTIONS:
Offset: 00003380 Enable/Disbale SafeOnLine. 01 = Disabled.

Offset: 00000B88 Enable/Disable "Right Click" Scanning in Windows Explorer. 00 = Disabled.
Offset: 000017DC Enable/Disable Automatically download and apply updates.
Offset: 000017A8 Enable/Disable Enhanced Rootkit Detection.
Offset: 00000B9C Enable/Disable Realtime Master Boot Record Scanning.
Offset: 0000323C Show the Authenticating files screen when a file being scanned.
Offset: 00000B98 Disable heuristics. 00 = Disbaled
Offset: 000017E4 Enable Scheduled Scans. 00 = Disbaled

How to modify Prevx options manually:
- Open "csidb.csi" with any HexEditor.
- Go to desired offset and change the option you want,
- Then restart your System for Prevx loads the file into memory with the new options.

IMPORTANT: Vulnerability published only for educational purposes. 



#  0day.today [2018-01-06]  #