what you don't know can hurt you
Home Files News &[SERVICES_TAB]About Contact Add New

PcwRunAs 0.4 Password Obfuscation Design Flaw

PcwRunAs 0.4 Password Obfuscation Design Flaw
Posted Mar 26, 2012
Authored by otr

The PcwRunAs software available from the PC-Welt website is prone to a trivial password recovery attack that allows local users to obtain passwords encrypted with the pcwRunAsGui.exe. pcwRunAs versions 0.4 and below are affected.

tags | exploit, local
advisories | CVE-2012-1793
SHA-256 | 811b545d5083c227c56986dbdeeac60ef0a1b6690230618e3d3b76f311c4ab12

PcwRunAs 0.4 Password Obfuscation Design Flaw

Change Mirror Download
# Vuln Title: PcwRunAs Password Obfuscation Design Flaw
# Date: 26.03.2012
# Author: Christian Landström, otr
# Software Link: http://www.pcwelt.de/downloads/pcwRunAs-1215998.html
# Version: <= 0.4
# Tested on: Windows
# CVE : CVE-2012-1793

# Risk: high
# Type: Privilege Escalation
# Vendor: PC-Welt

Timeline:

2012-03-19 Vendor contacted
2012-03-19 Vendor response
2012-03-19 CVE number requested
2012-03-20 CVE number assigned
2012-03-26 Public disclosure

Summary:

The PcwRunAs software available from the PC-Welt website is prone to a
trivial password recovery attack that allows local users to obtain
passwords encrypted with the pcwRunAsGui.exe.

Context:

PcwRunAs is a substitute for the RunAs tool included in the Windows
operating system. The tool allows to run commands in a different user
context. Usually this is used to execute commands that only higher
privileged users are allowed to run (like administrative or maintenance
tasks). Included in the PcwRunAs package is a tool called pcwRunAsGui
which features the creation of batch scripts that contain an encrypted
version of the command line arguments. This is used to hide the password
information from ordinary users that have access to the batch script but
should not know the administrator password. Currently two versions of
the tool are used in the wild. These are versions 0.3 and 0.4.

Design Flaw:

Both the PcwRunAsGui and the PcwRunAs tool share a common encryption key. By
design it is impossible to have PcwRunAs decrypt the string produced by
PcwRunAsGui and not give an attacker that wants to decrypt the cipher text
access to it. Hence the encryption key is embedded in the binaries of both
tools. This allows an attacker to reverse engineer the static encryption key
from the available binaries. The encryption key is derived from a RIPEDM-160
hash (160bits) that serves as initialization for the blowfish encryption
algorithm. This RIPEDM-160 hash is static for each version of the pcwrunas
tool as it is simply a hash sum of the pcwRunAs.exe executable file. The plain
text command line arguments get Blowfish-EBC encrypted with the static
RIPEDM-160 hash and the result encoded in base64, e.g. in version 0.3:

/u "admin" /p "test1234" /app "C:\WINNT\NOTEPAD.EXE"

Becomes, encrypted with blowfish and base64 encoded:

pEmoTVE5jk9r8X1An1CeuVU9yTOVN0SNG7XUZkec+/udmzjTvMOUyk2OofUkMNk/2y7KJkY=

As the string is blowfish EBC(!) encrypted it is possible to brute force
a given base64 string by hand, systematically trying different inputs
for the pcwrunasgui tool and trying to reproduce the encrypted string
one once to decipher.

By reverse engineering the binaries it is possible to extract the static
RIPEDM-160 hash that is used for encryption and write a tool that takes the
encrypted base64 string and decrypts it using the static RIPEDM-160 hash
(different in version 0.3 and 0.4). The version 0.4 features a
protection mechanism that salts the encryption key with the hard disk
serial number. However this feature is not widely used by enterprises as
administrative batch scripts are usually rolled out to many
workstations. This would mean that a new script would have to be created
on each workstation. In any case an attacker knowing the serial number
is again able to decrypt the cipher text by RIPEDM-160 hashing the number and
the key and using it as blowfish initialization.

Fix:

There is no trivial fix for this problem as this is a flaw by
design. As companies and individuals trust the pcwrunas tool for
securing their administrator password, we suggest that an advisory be
made public in order to inform administrators of the problem.

POC:

./decrypt_pcwrunas
Tool to decrypt blowfish-ebc from the PcwRunAs tool
Author: otr
---------------
Usage: decrypt_pcwrunas [version] [base64encryptedblowfish]

Example: decrypt_pcwrunas v0.3 pEmoTVE5jk9r8X1An1CeuVU9yTOVN0SNG7XUZkec+/udmzjTvMOUyk2OofUkMNk/2y7KJkY=
Example: decrypt_pcwrunas v0.4 EaVnXUyaAbve9Ef4K3QCm2dCzyH9znKcrZBwjaTLCgOT2sWBtCy38DEVTr5S

root@bt ~/Desktop/runwasdec # ./decrypt_pcwrunas v0.4 EaVnXUyaAbve9Ef4K3QCm2dCzyH9znKcrZBwjaTLCgOT2sWBtCy38DEVTr5S
[+] Decrypted: /u "aaaaaaa" /p /app "aaaaa" /arg "aaaaaa"

root@bt ~/Desktop/runwasdec # ./decrypt_pcwrunas v0.3 pEmoTVE5jk9r8X1An1CeuVU9yTOVN0SNG7XUZkec+/udmzjTvMOUyk2OofUkMNk/2y7KJkY=
[+] Decrypted: /u "admin" /p "test1234" /app "C:\WINNT\NOTEPAD.EXE"
Login or Register to add favorites

File Archive:

November 2022

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Nov 1st
    16 Files
  • 2
    Nov 2nd
    17 Files
  • 3
    Nov 3rd
    17 Files
  • 4
    Nov 4th
    11 Files
  • 5
    Nov 5th
    0 Files
  • 6
    Nov 6th
    0 Files
  • 7
    Nov 7th
    3 Files
  • 8
    Nov 8th
    59 Files
  • 9
    Nov 9th
    12 Files
  • 10
    Nov 10th
    6 Files
  • 11
    Nov 11th
    11 Files
  • 12
    Nov 12th
    1 Files
  • 13
    Nov 13th
    0 Files
  • 14
    Nov 14th
    9 Files
  • 15
    Nov 15th
    33 Files
  • 16
    Nov 16th
    53 Files
  • 17
    Nov 17th
    11 Files
  • 18
    Nov 18th
    14 Files
  • 19
    Nov 19th
    0 Files
  • 20
    Nov 20th
    0 Files
  • 21
    Nov 21st
    26 Files
  • 22
    Nov 22nd
    22 Files
  • 23
    Nov 23rd
    10 Files
  • 24
    Nov 24th
    9 Files
  • 25
    Nov 25th
    11 Files
  • 26
    Nov 26th
    0 Files
  • 27
    Nov 27th
    0 Files
  • 28
    Nov 28th
    20 Files
  • 29
    Nov 29th
    9 Files
  • 30
    Nov 30th
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Hosting By
Rokasec
close