[TOOL] UltraEdit FTP-Password Decoder

From: support@securiteam.com
Date: 09/05/01 

From: support@securiteam.com
To: list@securiteam.com
Subject: [TOOL] UltraEdit FTP-Password Decoder
Message-Id: <20010905205343.8E555138C0@mail.der-keiler.de>
Date: Wed,  5 Sep 2001 22:53:43 +0200 (CEST)

The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion

When was the last time you checked your server's security?
How about a monthly report?
http://www.AutomatedScanning.com - Know that you're safe.
- - - - - - - - -

  UltraEdit FTP-Password Decoder
------------------------------------------------------------------------

DETAILS

This piece of VB code will decode the passwords stored in uedit32.ini for
the FTP accounts

' UltraEdit FTP password decryption (stored in uedit32.ini)
'
' Taken from the help-file:
'
' This checkbox determines if UltraEdit will save the password for later
' reference. If not the user will be prompted for the password as
required. Note
' - if the password is saved it is stored on the system. It is encrypted
however
' the encryption mechanism is unsophisticated and should not be relied
upon as a
' method of security.

' Masterkey. Taken from the UltraEdt.exe
Private Const Masterkey = "sdfkh we;34u[ jwef "

'Decode a single character
Public Function UEDecode(i_Asc, ByVal i_Pos As Integer)

   i_Pos = i_Pos Mod 19
   If i_Pos = 0 Then i_Pos = 19
   
   UEDecode = ((Not i_Asc) And Asc(Mid(Masterkey, i_Pos, 1))) + (i_Asc And
((Not Asc(Mid(Masterkey, i_Pos, 1))) And 127))
   
End Function

'Decode password
Public Function UEDecodeString(str_password As String)

   Dim i As Integer

   UEDecodeString = ""

   For i = 1 To (Len(str_password) / 2)
      UEDecodeString = UEDecodeString + Chr$(UEDecode(Val("&H" +
Mid(str_password, (2 * (i - 1)) + 1, 2)), i))
   Next i

End Function

ADDITIONAL INFORMATION

The tool has been provided by <mailto:evelk@dsv.nl> E. van Elk.

========================================

This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com
In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com

====================
====================

DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any kind.
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.

Relevant Pages

  • [NT] Microsoft Internet Explorer % Encoding Security Issue (CSS)
    ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... name that is used by the cookie domain to decode differently from that of ... In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages. ...
    (Securiteam)
  • Re: Usenet image display
    ... I have not been able to do a combine and decode, with the new security in ... O.E. - am I blind or is this also impossible using the "Read in plain text" ... Protect your PC ...
    (microsoft.public.windows.inetexplorer.ie6_outlookexpress)
  • Re: Capture Pswrd & Userid To Auto Populate Form
    ... the user audience does not have access knowledge. ... Create a new public function in that same module: ... Public Function GetUserID() ... For the best security ...
    (microsoft.public.access.formscoding)
  • Re: Converting a VB.Net Console Application to a Web Service
    ... Have you tried running the web service in a user security context? ... Public Function extractPST(ByVal fileName As String) As String ...
    (microsoft.public.dotnet.framework.webservices)
  • [NEWS] Adobe Flash Player ActiveX Control Universal Cross-Site Scripting Vulnerability
    ... Get your security news from a reliable source. ... Adobe Flash Player ActiveX Control Universal Cross-Site Scripting ... This vulnerability allows remote attackers to run arbitrary JavaScript ... public function DoAttack:void { ...
    (Securiteam)