Amsn Discloses Password Hashes

Full Version: Amsn Discloses Password Hashes

GovernmentSecurity.org > The Archives > Exploit Articles

qcred11

Jun 22 2004, 06:58 PM

QUOTE

Hello :
i found this bug in amsn client :
http://sourceforge.net/tracker/index.php?f...091&atid=472655

Windows

=============================================================================
1. Introduction
2. What it was tested on
3. How to reproduce the exploit
4. Conclusion
5. Fix
=============================================================================
1. After studying the instant messager client aMSN (v0.90)for
windows and looking in their files; I noticed that a local maliciously user
could obtain with hash one user who were logged in amsn:
=============================================================================

2. This was tested on:
Amsn v 0.90 client
win 2000 pro sp4 built 2195
=============================================================================
3. To reproduce this vulnerability, it´s necessary to follow these instructions:
open the messenger client amsn; login hotmail wih our user and password.
After we open our e-mail and we click in the tray enveloppe who notices that we
have a new mail,
the explorer is open and we see that locally one page is open
from the local place, file:///C:/Documents%20and%20Settings/Lostmon/amsn/hotlog.htm
As we can see, this is the local route from de profile user who started the
session in the pc :/
If we open this folder and we see this route, specially this file we find the
following:
=============================================================================
code of file hotdog.htm

<html>
<head>
<noscript>
<meta http-equiv=Refresh content="0; url=http://www.hotmail.com">
</noscript>
</head>
<body onload="document.pform.submit(); ">
<form name="pform"
action="https://loginnet.passport.com/ppsecure/md5auth.srf?lc=1033" method="POST">
<input type="hidden" name="mode" value="ttl">
<input type="hidden" name="login" value="yourfull">
<input type="hidden" name="username" value="yourfull@hotmail.com">
<input type="hidden" name="sid" value="507">
<input type="hidden" name="rru" value="/cgi-bin/HoTMaiL">
<input type="hidden" name="auth"
value=& quot;58eRJLDWhDzdS64AsWCR1FKtjcWTkW76jtnGCOdp7bvlsr1wUHbfGLystSU6ig6bpdx7zGmj15d
2MmglLZxr!iAQ$$">
<input type="hidden" name="creds" value="a93e78753eed0fe90ae59a9245d459d0">
<input type="hidden" name="svc" value="mail"><input type="hidden" name="js"
value="yes">
</form>
</body>
</html>
=============================================================================

Looking this infomation we noticed how is the sending way used in this form,
executed
under "hidden" mode, here we have so many important things.

But things are not finished here, if we look in the folder %userroot%amsn\
looking very careful we have a config.xml and in his last lines has this entry :
=============================================================================
part of code of config.xml

<entry>
<attribute>remotepassword</attribute>
<value>c26ccaaba25f6642</value>
</entry>
ummmmmm

What is remote password and how it´s possible to obtain ??
We suppose that remote password is the password who allows identify every account :/
thus if we make a through investigation looking from where is this remote
password coming from, we arrive to folder c:\program files \amsn\scripts\
and if we look among these files we find: config.tcl
In the line 296 we have this:
}

if { ($config(save_password)) && ($password != "")} {

set key [string range "${loginback}dummykey" 0 7]
binary scan [::des::encrypt $key "${password}\n"] h* encpass
puts $file_id " <entry>\n <attribute>encpassword</attribute>\n
<value>$encpass</value>\n </entry>"
}

set key [string range "${loginback}dummykey" 0 7]
binary scan [::des::encrypt $key "${config(remotepassword)}\n"] h* encpass
puts $file_id " <entry>\n <attribute>remotepassword</attribute>\n
<value>$encpass</value>\n </entry>\n"

foreach custom $config(customsmileys2) {
puts $file_id " <emoticon>"
foreach attribute [array names emotions] {
if { [string match "${custom}_*" $attribute ] } {
set var_attribute [::sxml::xmlreplace [string map [list "${custom}_" ""]
$attribute ]]
set var_value [::sxml::xmlreplace $emotions($attribute)]
puts $file_id " <$var_attribute>$var_value</$var_attribute>"
}

=============================================================================
These are functions that codify the remote password umm :/
If we could look the background in this file we will be able to say that there
are the variables neccessaries to revert certains functions.

Yours faithfully

#dismarking

Source: http://www.securitytracker.com/alerts/2004/Jun/1010555.html

xlulux

Jun 23 2004, 03:58 AM

good exploit, too bad everyone is "SERV-U"-ing their way to glory now a days i wish we could go back to the one box at a times days

the bad things are that he never got around to #4,5

imho the most important

SOLUTION

keep up the good works guys

Kynroxes

Jun 25 2004, 09:07 PM

yes great topic ...
really interesting and your posts are always originals, tks u man !!

This is a "lo-fi" version of our main content. To view the full version with more information, formatting and images, please click here.