Exploit Computer Associates eTrust Intrusion Detection 1.4.1.13 - Weak Encryption

Exploiter

Хакер
34,599
0
18 Дек 2022
EDB-ID
20012
Проверка EDB
  1. Пройдено
Автор
PHATE.NET
Тип уязвимости
LOCAL
Платформа
WINDOWS
CVE
cve-2000-0559
Дата публикации
2000-06-07
Код:
source: https://www.securityfocus.com/bid/1341/info

A weak encryption scheme exists in Computer Associates eTrust Intrusion Detection System (formerly known as SessionWall-3) password which authorizes users to view and configure the application's registry settings.

Provided that either a remote or local user has access to the registry, it is possible to decrypt the password into plaintext with the use of an exploit tool (sw3passw.exe) or through simple XORing techniques.

This password along with the key is stored in the following registry location:
HKEY_LOCAL_MACHINE\Software\ComputerAssociates\SessionWall\1.0\Security\AdminPassword

The first byte will be the length of the key (n), the next (n) bytes are the key, the remaining bytes are the encrypted password with the exception of the last byte which is a terminating null. 

20012-1.exe - Administrator password decryptor for Win 9x/NT.
20012-2.zip - Source code (use TASM). 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/20012-1.exe

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/20012-2.zip
 
Источник
www.exploit-db.com

Похожие темы