S24EvMon.exe Exploit

mir

http://www.milw0rm.com/exploits/1772

/**********************************************************************************************************
* Testing a vuln-finder application that I am developing, I found a flaw within S24EvMon.exe.
* It is a service which is part (at least) of the Intel PROset/Wireless software. This application
* is provided by Intel in order to support intel Wireless Devices based on Spectrum 24 chipsets.
*
* This service uses a shared memory section which is created without the proper security descriptor,
* allowing unprivileged users to perform operations like Delete, Read or Write into the memory. The
* section is named S24EventManagerSharedMemory
*
* This shared memory is used to store ,in plain text, confidential information like WEP Key, Passwords...
*
* The successful exploitation of this vulnerability could allow to any unprivileged user to access
* confidential information,exposing the network. An important mitigating factor is that the
* vulnerability is local, nevertheless some Malware could take advantage of this flaw.
**********************************************************************************************************/

* This shared memory is used to store ,in plain text, confidential information like WEP Key, Passwords...

this is the key sentence :P

can anyone take a closer look at the link and code posted and give feedback
http://www.milw0rm.com/exploits/1772

Padre

this a pretty old exploit. and it's not an "proper" exploit. well it exploits a dumb mistake if u want but not more :P
it just opens the memory section of the proc, reads the data and dumps it. it's pretty much useless in most cases cause u'll need to have rooted the machine, and in this case, this will only speed up the process of info gathering.