s0h: Remote/Local exploit and patch for regedit.exe.

[descript <descript () sv98 s0h cc>]

Hi,

The april 17, 2002, an strange exploit about a new vulnerability of regedit.exe was posted on the NTBugtraq list 
(http://sv98.s0h.cc/~threat/source/TrapReg.c).

This exploit can trapped an local key, that allow users to browse our register localy or _remotely_.

Today, the Monday 28 April 2003, ThreaT <ThreaT () s0h cc> from the Skin Of Humanity released the patch related to the 
exploit. This patch was released BEFORE Microsoft Corporation(c)(r)(tm).

Please enjoy the source code at http://www.s0h.cc/~threat/goodies/regpatch/source_regpatch.zip
Executable patch : http://www.s0h.cc/~threat/goodies/regpatch/regpatch.exe
Article (french, will be translated in few hours) : http://sv98.s0h.cc/~threat/goodies/regpatch/

Actualy this patch was tested on Windows SERVER/PRO 2000 SP2 and SP3 and regedit.exe version 5.0.2134.1 we don't sure 
that it's work for English version...

Please note : 
        The Skin Of Humanity Group protect all its members.if a problem occurs concerning this diffusion, the author is 
not responsible, the leader of the group is in all the responsible case of cause. Since the diffusion does not come 
from the creator but from the group. Thank you. 

Best regards and respect, 
Descript. <descript () s0h cc>
Skin Of Humanity
http://s0h.cc/