Onderwerp: RE: Writing Trojans that bypass Windows XP Service Pack 2 Firewall

I am sorry, I thought (from a previous email in this or another list, I
am getting forgetful in my old age) that editing these two registry
entries would allow an app to, well if not bypass, at least be allowed
thru the firewall.


Application Exceptions:=20
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\S haredAccess\Parameters
\FirewallPolicy\StandardProfile\AuthorizedApplicat ions\List=20


Port Exceptions:=20
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\S haredAccess\Parameters
\FirewallPolicy\StandardProfile\GloballyOpenPorts\ List=20


Is there something I am missing (again)?

Is this another example of "If you click on the .exe, you are exposed"
type of exploit?=20

Are you demo'ing the fact that you can attach yourself to a system
process and not be detected by XPSP2?=20

How did you get the code on the SP2 system? Email an .exe?

I thought the best part of XPSP2 was prevention of code from running on
your system. This includes password guesses, bunches of malware, NMAP
scans, and compiled programs.

To further demonstrate my point, I wrote this exploit that will disable
the WinXP firewall as well, simply extract this text into a .bat file
and double-click on it:

net stop "Windows Firewall/Internet Connection Sharing (ICS)"

-JP

MCSEnator CCaNT CISSPell OPSTinate

In-Reply-To: <FEBC66CCD411744381228574BAB53A9B8035D0@MAIL.fac.g atech.edu>

A trojan could just as easily, disable the firewall with
a simple net stop command. I posted this yesterday but failed to get it listed for some reason.

http://habaneronetworks.com/viewArticle.php3?ID=51

An EXE would only be able to change firewall settings if it was running
under an account with administrative privileges.

Indeed, a user who conducts day-to-day activities using an
administrative account is very much exposed to the type of attack you
describe (malicious exe writing to HKEY_LOCAL_MACHINE or stopping the
firewall service). Security best practices (on any OS) forbid using an
administrative account for day-to-day activities.

Simon

-----Original Message-----
From: Polazzo Justin [mailto:Justin.Polazzo@facilities.gatech.edu]
Sent: Friday, October 15, 2004 1:11 PM
To: americanidiot@hushmail.com; bugtraq@securityfocus.com
Subject: RE: Writing Trojans that bypass Windows XP Service Pack 2 Firewall


I am sorry, I thought (from a previous email in this or another list, I
am getting forgetful in my old age) that editing these two registry
entries would allow an app to, well if not bypass, at least be allowed
thru the firewall.


Application Exceptions:
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\S haredAccess\Parameters
\FirewallPolicy\StandardProfile\AuthorizedApplicat ions\List


Port Exceptions:
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\S haredAccess\Parameters
\FirewallPolicy\StandardProfile\GloballyOpenPorts\ List



Is there something I am missing (again)?

Is this another example of "If you click on the .exe, you are exposed"
type of exploit?

Are you demo'ing the fact that you can attach yourself to a system
process and not be detected by XPSP2?

How did you get the code on the SP2 system? Email an .exe?

I thought the best part of XPSP2 was prevention of code from running on
your system. This includes password guesses, bunches of malware, NMAP
scans, and compiled programs.

To further demonstrate my point, I wrote this exploit that will disable
the WinXP firewall as well, simply extract this text into a .bat file
and double-click on it:

net stop "Windows Firewall/Internet Connection Sharing (ICS)"

-JP

MCSEnator CCaNT CISSPell OPSTinate